Part 2: Upsetting Opinions about Static Analyzers

by Andrey karpov

And started coming up with cases when it might be justified, which means that the PVS-Studio analyzer warning was a false-positive. Some speculations about the change in memory between two checks came into play which occurs due to:

• running parallel threads;
• signal/interrupt handlers;
• the variable X is a reference to the element A[0];
• hardware, such as performing DMA operations;
• and so on.

After heated debate on the analyzer's inability to comprehend all cases, they left to cut down forest with axes. In other words, they found an excuse why they could still avoid using a static code analyzer in their work.

Upsetting Opinions about Static Analyzers

by Andrey Karpov

Of course, any modern static analyzer tracks the changes of variables' values. If a variable doesn't change, a warning is issued. If it does, no warning is issued. To ensure that, analyzers rely on data stream analysis. And that's exactly how PVS-Studio works. Let's take a look at the following synthetic example.

Why it is important to apply static analysis for open libraries that you add to your project

by Andrey Karpov

Because of a typo, the original vector is returned, not the new scaledVector container. The same error occurs in the division operator. Facepalm. Again, these errors don't mean anything separately. Although, this is a hint that this library isn't used much and there is highly likely that there are other serious undetected errors in it.

PVS-Studio 7.09

by Andrey Karpov

New general analysis diagnostics:

•     V1059. Macro name overrides a keyword/reserved name. This may lead to undefined behavior.
•     V1060. Passing 'BSTR ' to the 'SysAllocString' function may lead to incorrect object creation.
•     V1061. Extending 'std' or 'posix' namespace may result in undefined behavior.
•     V1062. Class defines a custom new or delete operator. The opposite operator must also be defined.
•     V1063. The modulo by 1 operation is meaningless. The result will always be zero.

PVS-Studio: analyzing pull requests in Azure DevOps using self-hosted agents

by Alexey Govorov

The result is a build system based on MSBuild for C++, with Chocolatey for installing PVS-Studio, CMake, and Git. Vcpkg is built for convenient management of the libraries that the project depends on. Also, we have to download the latest version of the Azure Pipelines Agent. To initialize the agent from the ENTRYPOINT Docker file, the PowerShell script 'entrypoint.ps1' is called, to which you need to add the URL of the project's "organization", the token of the agent pool, and the PVS-Studio license parameters....

PVS-Studio is now in Compiler Explorer

by George Gribkov

If you want to see the output of your program, you can open the execution window by clicking "Add new... - > Execution only" in the code editor (not in the compiler window). In the gif below, you can see the output of the lab work taken from our page about free usage of PVS-Studio by students and teachers.

A Note of Caution about Using PVS-Studio on godbolt.org (Compiler Explorer)

by Andrey Karpov

This may be promising from the perspective of satisfying one's curiosity, writing articles, and so on. But there's a downside to it too: rather than using synthetic examples to explore or try out the tool, people may start relying on them to evaluate and compare it against other analyzers. And this is a very bad approach because the results will be unreliable and dependent on how the test examples are written.

PVS-Studio 7.05

by Andrey Karpov

The Blame Notifier utility meant to notify developers about the analysis results is now available on all platforms supported by the analyzer (Windows, Linux, macOS). Blame Notifier uses the information from the version control system (SVN, Git, Mercurial) to identify the person who wrote the code that triggered an analyzer warning.

For professors' note: use PVS-Studio to get students familiar with code analysis tools

by Andrey Karpov

The PVS-Studio analyzer can be regarded as a fine example of a modern static code analysis tool. First, it's a great example to show the abilities of static analysis tools in detecting errors and security defects. Second, you can demonstrate its integration into the software development cycle to enable continuous code control. In its example, you can show integration with such systems as Jenkins, TeamCity, Azure DevOps, SonarQube, Travis CI and others.

Getting Started with the PVS-Studio Static Analyzer for C++ Development under Linux

by Yuri Minaev

Besides strace, you can base the analysis on the compile_commands.json (JSON Compilation Database) file. Many build systems have built-in means of exporting compilation commands, or you could use the BEAR utility to do this. Here's the command to launch the analysis in this case: pvs-studio-analyzer analyze –f /path/to/compile_commands.json