PVS-Studio features overview (2020)

PVS-Studio features overview
Windows, Linux, macOS
C, C++, C#, Java
Phillip Khandeliants
khandeliants@viva64.com

Speaker
 Lead C++/C# developer in PVS-
Studio team
 Have been working in the
company since 2016
 Popularizing modern C++

 Static code analyzers for C, C++, C++/CLI, C++/CX,
C#, and Java on Windows, Linux and macOS;
 Supported compilers (C/C++): MSVC, GCC, Clang,
MingW, ARM GCC, ARM Clang, Keil ARM
Compiler 5/6, IAR C/C++ Compiler for ARM, TI
ARM CGT;
 Plugins for Visual Studio 2010-2019, Rider, IntelliJ
IDEA;
PVS-Studio infrastructure

 Compilation monitoring utility for performing
analysis independently of the IDE or build system
(C/C++ only);
 Suppress files: ability to view warnings only on
newly written code;
 Incremental analysis: automatic analysis of changed
files

 Integration with TeamCity, Azure DevOps, Travis CI,
CircleCI, GitLab CI/CD, Jenkins, SonarQube, etc.
 PlogConverter utility to convert raw log to desirable
format
 BlameNotifier utility to distribute warnings by mail

 C, C++ diagnostics : 510
 C# diagnostics : 153
 Java diagnostics : 82
By July 2020 we’ve implemented in PVS-Studio:

 Copy-paste errors
 Array index out of bounds
 Buffer overrun
 Memory/resource leaks
 Invalid operator precedence
 Dereferencing of nullable types
 Dead/unreachable code
 Use of uninitialized variables
 Undefined/unspecified behavior
 ….
What can be detected?

Great attention is paid to analyzer warnings:
 Warnings classification is supported according to:
 Common Weakness Enumeration (CWE)
 SEI CERT C Coding Standard
 SEI CERT C++ Coding Standard
 MISRA C, MISRA C++
 Detailed documentation in Russian and English:
 Online
 PDF

Diagnostic capabilities of PVS-Studio

 This error demonstrates greatly how DataFlow analysis works in
PVS-Studio
 This error was found using PVS-Studio in Chromium project
(Protocol Buffers)
 The analyzer issues two warnings:
 V547 Expression 'time.month <= kDaysInMonth[time.month] + 1' is always
true. time.cc 83
 V547 Expression 'time.month <= kDaysInMonth[time.month]' is always true.
time.cc 85
Data Flow analysis

static const int kDaysInMonth[13] = {
0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};
bool ValidateDateTime(const DateTime& time) {
if (time.year < 1 || time.year > 9999 ||
time.month < 1 || time.month > 12 ||
time.day < 1 || time.day > 31 ||
time.hour < 0 || time.hour > 23 ||
time.minute < 0 || time.minute > 59 ||
time.second < 0 || time.second > 59) {
return false;
}
if (time.month == 2 && IsLeapYear(time.year)) {
return time.month <= kDaysInMonth[time.month] + 1;
} else {
return time.month <= kDaysInMonth[time.month];
}
}

static const int kDaysInMonth[13] = {
0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};
bool ValidateDateTime(const DateTime& time) {
if (time.year < 1 || time.year > 9999 ||
time.month < 1 || time.month > 12 ||
time.day < 1 || time.day > 31 ||
time.hour < 0 || time.hour > 23 ||
time.minute < 0 || time.minute > 59 ||
time.second < 0 || time.second > 59) {
return false;
}
if (time.month == 2 && IsLeapYear(time.year)) {
return time.month <= kDaysInMonth[time.month] + 1;
} else {
return time.month <= kDaysInMonth[time.month];
}
} time.day

int x0 = ....; int x1 = ....;
int y0 = ....; int y1 = ....;
assert(x0 <= x1 && "....");
assert(y0 <= y1 && "....");
assert((x1 - x0) == (y1 - y0) && "....");
assert(x0 >= 0 && x0 < int(some_value) && "....");
assert(x1 >= 0 && x1 < int(some_value) && "...."); // x1 >= 0
assert(y0 >= 0 && y0 < int(some_value) && "...."); // y0 >= 0
assert(y1 >= 0 && y1 < int(some_value) && "...."); // y1 >= 0
Symbolic execution
V560 A part of conditional expression is always true.

Method/class annotations
Our team has annotated thousands of functions and classes, given in:
 standard C library
 standard С++ library
 WinAPI
 glibc (GNU C Library)
 Qt
 MFC
 and so on

void EnableFloatExceptions(....)
{
....
CONTEXT ctx;
memset(&ctx, sizeof(ctx), 0);
....
}
Method/class annotations
V575 The 'memset' function processes '0' elements. Inspect the third argument.
crythreadutil_win32.h 294
This error was found using PVS-Studio in CryEngine V project

static void FwdLockGlue_InitializeRoundKeys()
{
unsigned char keyEncryptionKey[KEY_SIZE];
....
memset(keyEncryptionKey, 0, KEY_SIZE); // Zero out key data.
}
Pattern-based matching analysis
V597 CWE-14 The compiler could delete the 'memset' function call, which is used to flush
'keyEncryptionKey' buffer. The memset_s() function should be used to erase the private data.
FwdLockGlue.c 102
This error was found using PVS-Studio in Android
project

 For VS2010-2019: just install plugin and check your solution!
 For other cases you can capture compiler invocations and gather all needed
information for the analysis
Using PVS-Studio: quick start
Windows:
 C and C++ Compiler Monitoring UI tool
Linux/macOS
 pvs-studio-analyzer utility

Using PVS-Studio: mass suppression
 It can be difficult to start using static analysis in a large project
 It’s not clear what to do with warnings in old code
 We suggest a decision: hiding messages using suppress files

Using PVS-Studio: suppressing of false positives
 Various ways to suppress false positives in specific lines of code
 Suppression of false positives in macros
 Suppression of false positives using pvsconfig diagnostics
configuration files

Using PVS-Studio: excluding from analysis
 Possibility to exclude files from analysis by their name, directory or mask
 Interactive filtration of analysis results (log) in PVS-Studio window:
 by diagnostic code and warning level
 by the file name
 by including the word in the text of a diagnostic

 The most efficient way of fixing an error is to do it right after it
appeared in code
Using PVS-Studio: automatic analysis of files after
their recompilation

Using PVS-Studio: scalability
 Support of multicore and multiprocessor systems with configuration
of the number of utilized cores
 IncrediBuild support

 Running analysis from command line for
checking the whole project
 Saving and loading of analysis results
 Using of relative paths in report files
 Send mail notifications with
BlameNotifier utility
Using PVS-Studio: continuous integration

 Convenient online reference on all diagnostics
Using PVS-Studio: documentation

 We developed a plugin for importing analysis results into SonarQube
 Using of this plugin allows to add warnings found by PVS-Studio
analyzer to the warnings base of SonarQube server
Using PVS-Studio: SonarQube

 Write to us: support@viva64.com
 Subscribe:
 Twitter: @Code_Analysis
 RSS: http://feeds.feedburner.com/viva64-blog-en
 Facebook: https://www.facebook.com/StaticCodeAnalyzer
 Telegram: https://t.me/pvsstudio_en
 Download PVS-Studio:
https://www.viva64.com/download_cpp_on_sea/
Thank you for attention!

PVS-Studio features overview (2020)

More Related Content

What's hot (20)

Similar to PVS-Studio features overview (2020) (20)

More from Andrey Karpov (20)

Recently uploaded (20)

PVS-Studio features overview (2020)

Editor's Notes