PVS-Studio 7.07: Features Overview

by Ekaterina Nikiforova

The next command I'd like to talk about is called "Display CWE Codes in Output Window". PVS-Studio is a static application security testing (SAST) tool, which means its warnings can be classified according to the Common Weakness Enumeration (CWE).
 

PVS-Studio 7.07

by Svyatoslav Razmyslov

In between the analyzer releases, Microsoft pushed out several updates for the Visual C++ compiler, which comprised initial support of the C++20 standard, for example, concepts. Unfortunately, when running the analyzer some users stumbled upon the error V003 - Unrecognized error found. We're glad to inform that this error is fixed in PVS-Studio 7.07. Concepts are supported.
 

PVS-Studio Integration in PlatformIO

by Alexey Govorov

In the /arduino/AP_Utils/examples/ directory, there are several examples of programs for configuring and running the hexapod, we'll use servo_test.ino. Basically, the program for Arduino is created as sketches in the INO format, which in this case is not quite suitable. In order to make the correct .cpp file from it, it is usually enough to change the file extension, add the #include <Arduino.h> header at the beginning, and make sure that functions and global variables are declared before accessing them.

Top 10 Bugs Found in C++ Projects in 2019

by Maxim Zvyagintsev

float yScale = 1.0 / tan((3.141592538 / 180.0) * fov / 2);

There's a tiny typo in the Pi number (3,141592653...): the number "6" is missing at the 7th decimal place.
 

For professors' note: use PVS-Studio to get students familiar with code analysis tools

by Andrey Karpov

The PVS-Studio analyzer can be regarded as a fine example of a modern static code analysis tool. First, it's a great example to show the abilities of static analysis tools in detecting errors and security defects. Second, you can demonstrate its integration into the software development cycle to enable continuous code control. In its example, you can show integration with such systems as Jenkins, TeamCity, Azure DevOps, SonarQube, Travis CI and others.

Getting Started with the PVS-Studio Static Analyzer for C++ Development under Linux

by Yuri Minaev

Besides strace, you can base the analysis on the compile_commands.json (JSON Compilation Database) file. Many build systems have built-in means of exporting compilation commands, or you could use the BEAR utility to do this. Here's the command to launch the analysis in this case: pvs-studio-analyzer analyze –f /path/to/compile_commands.json

PVS-Studio in the Clouds - Running the Analysis on Travis CI

by Oleg Andreev

Travis CI is a service for building and testing software that uses GitHub as a storage. Travis CI doesn't require changing of programming code for using the service. All settings are made in the file .travis.yml located in the root of the repository. We'll take LXC (Linux Containers) as a test project for PVS-Studio. It is a virtualization system at the operation system level for launching several instances of the Linux OS at one node. The project is small, but more than enough for demonstration.

PVS-Studio: Support of MISRA C and MISRA C++ Coding Standards

by Andrey Karpov

Such diagnosis can't be applied to already existing projects developed for Windows, Linux or macOS operating systems. For example, only one rule about curly brackets described above gives 1947 warnings of the V2507 diagnostic (MISRA C 15.6, MISRA C++ 6-4-1) for a WinMerge project. Still WinMerge is a small project! In total, only 250 000 lines of code in C and C# languages.

Technologies used in the PVS-Studio code analyzer for finding bugs and potential vulnerabilities

by Andrey Karpov

Here a mixture of technologies is working: data flow analysis, symbolic execution, and automatic method annotation (we will cover this technology in the next section). The analyzer sees that X variable is used in the Div function as a divisor. On this basis, a special annotation is built for the Div function. Further it is taken into account that in the function a range of values [0..4] is passed as the X argument. The analyzer comes to a conclusion that a division by 0 has to occur.

PVS-Studio 6.26 Released

by Andrey Karpov

A developer believes that this is a bug in the compiler. Nevertheless, it is the author of the code who is wrong. The function does not work correctly due to the fact that undefined behavior occurs in it. The compiler follows that in the r variable a certain sum is calculated. Overflow of the r variable must not happen. Otherwise, it is undefined behavior, which doesn't have to be considered or taken into account by a compiler. So, the compiler thinks that since the value of r variable after ending the loop cannot be negative, then r & 0x7fffffff operation is not needed to reset the sigh bit and the compiler just returns the value of r variable from the function.