CBMC vs Flawfinder
CBMC
cprover.org
Flawfinder
dwheeler.comSide by side
| Figure | CBMC | Flawfinder |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · C and C++ Static Analysis Tools | 8.7 (#2) | 8.1 (#9) |
| License | The maker identifies the license as BSD 4-clause; its terms permit redistribution and use in source or binary form subject to conditions. | Flawfinder is released under GNU General Public License version 2 or later, with SPDX expression GPL-2.0+. |
| Purpose | CBMC is a bounded model checker for C and C++ programs. | Flawfinder examines C/C++ source code and reports possible security weaknesses sorted by risk level. |
| Support | The CBMC page directs questions to Daniel Kroening, and the CPROVER manual links to Google Groups support and announcements. | The project directs general questions to its mailing list and specific bugs or feature requests to git or the issue tracker on SourceForge. |
Plans
In their own words
CBMC
CBMC is a bounded model checker for C and C++ programs, available for Linux, macOS, and Windows. It checks memory safety, including array bounds and pointer use, along with several forms of undefined behavior and user-specified assertions. Its language range includes C89, C99, most of C11 and C17, and extensions from GCC, Clang, and Visual Studio. CBMC verifies by unwinding program loops and passing the resulting equation to a decision procedure. It can check C and C++ I/O equivalence with languages such as Verilog, and generate test cases for branch, decision, path, and MC/DC coverage. Listed language features include arrays, dynamic memory, nondeterminism, assumptions, assertions, and selected C++ features such as classes, templates, and STL containers. A MiniSat-based bit-vector solver is included; Boolector, CVC5, and Z3 are supported but must be installed separately. CBMC is free at free under a BSD 4-clause license. The Windows and macOS distributions are command-line tools without a GUI.
Flawfinder
Flawfinder is a free tool for finding possible security weaknesses in C and C++ source code. It compares source text with a built-in database of functions associated with security problems, generally disregarding comments and strings except for Flawfinder directives. Findings are ordered by risk, which depends on the function and its parameter values; the tool may reduce some false positives when it identifies a construct as not risky. Reports can be generated as text, HTML, CSV, or SARIF. The --patch option narrows findings to changed lines in a unified diff, with a one-line margin. Installation is documented through pip, source downloads, and distribution packages, and the tool requires Python 2.7 or Python 3. The project says it works on Unix-like systems, including GNU/Linux, and on Windows with Cygwin; direct Windows use has also been reported to work. Flawfinder is released under GPL-2.0+. It does not perform control-flow or data-flow analysis, so its output is an aid to review rather than a substitute for security knowledge or human judgment.