Infer vs SeaHorn

Infer is a static analysis tool that examines compiled Java, C, C++, Objective-C, and Erlang code and reports potential bugs before release. Its checks include null pointer problems, resource or memory leaks, coding conventions, unavailable APIs, and concurrency issues such as data races. Some analyses can follow an issue across multiple functions or methods and files. Pulse provides memory-safety analysis, while RacerD checks thread safety. Cost analysis estimates asymptotic function complexity for Java and C-family languages; Hack support is experimental, and Python, Rust, and Swift are not supported by that analysis. Infer captures compilation commands, analyzes the captured files, and writes reports that can be reviewed with `infer explore`; files that are not compiled are not analyzed. Integrations are documented for build tools including Buck, CMake, Gradle, Make, Maven, Xcodebuild, and xctool. It can be installed from binary releases, built from source, or run in Docker. The free plan costs nothing. Infer runs on Linux and macOS, with web and self-hosted options; Windows is not supported.

SeaHorn is a free, open-source framework for automated analysis of C and other LLVM-based programs, developed mainly for research in automated verification. It is not an out-of-the-box static analyzer. Its frontend prepares LLVM IR bitcode, and its middle end converts optimized bitcode into verification conditions written as Constrained Horn Clauses. Backend engines use SMT-based model checking, including PDR/IC3 techniques, and CRAB can provide numerical invariants through abstract interpretation. SeaHorn supports abstract interpretation, context-sensitive pointer analysis, bounded model checking, constrained-Horn-clause software model checking, and termination or non-termination analysis. For C programs with assertions, `sea pf` translates the program, generates and solves verification conditions, displays invariants for safe results, or saves a counterexample for violations. `sea inspect` reports program structure and can produce memory or call-graph data. The framework also checks generated clauses for inconsistent code fragments using path coverage. Docker is described as the easiest starting point, with a nightly image refreshed daily. Building requires LLVM, Z3, and Boost, whose exact versions change. SeaHorn runs on Linux, macOS, or self-hosted systems under a modified BSD license.