Skip to content

Bug Hunter: deep C/C++ defect checks

Bug Hunter is a set of deep, path-sensitive C/C++ checks that go beyond ordinary rule/standard conformance to find real runtime defects. It explores execution paths through your code — tracing control and data flow — to catch bugs that pattern-based checks miss.

Bug Hunter finds eight classes of defect:

  • Division by zero
  • Null pointer dereference
  • Undefined call
  • Stack address escape (a stack address that outlives its function)
  • Uninitialized value
  • Dangling pointer (use-after-free / double-free, for new/delete and malloc/free)
  • Memory leak
  • Virtual call (problematic virtual call during construction/destruction)

C/C++ only

Bug Hunter checks apply to C and C++ code only. They require a Bug Hunter license feature; without it, these checks are hidden. They are also included in SciTools' Recommended Checks.

Run Bug Hunter

Bug Hunter checks run like any other CodeCheck check — you add them to a configuration and inspect.

  1. Checks → Select Checks to open Manage Configurations.
  2. Select the built-in Bug Hunter standard (or duplicate it and trim to the checks you want).
  3. Run it — see run your first check for the full flow.

To have Bug Hunter run continuously as you edit, add its checks to a background configuration — see run CodeCheck automatically in the background.

Plan for the cost

Bug Hunter's thoroughness is expensive. It explores many execution paths and stores extra analysis data on disk.

Time and disk space

Bug Hunter checks take significantly longer to run than ordinary checks, and require extra disk space — typically on the order of 1 GB to 4 GB per 100,000 lines of code, depending on the code. Budget for this before running on a large codebase.

Improve accuracy

For the most accurate results, enable Cache AST Files in Project → Configure Project → C++ before analyzing.

See what CodeCheck can check for how Bug Hunter fits alongside standard and custom checks. Many Bug Hunter defect classes (buffer misuse, use-after-free, uninitialized reads) are also security weaknesses — see check code for security vulnerabilities.