PVS-Studio is a industrial static code analyzer developed by PVS-Studio LLC. It’s designed to assist software program builders detect errors and potential vulnerabilities of their code by analyzing it with out really working it. The instrument helps a number of programming languages: C, C++, C#, and Java. This makes it a flexible choice for groups engaged on tasks with completely different language necessities.
Desk of Contents
How PVS-Studio works
PVS-Studio has a set of diagnostic guidelines that assist builders to detect errors in addition to to look at the error and repair it. After PVS-Studio is built-in into an IDE, it runs the evaluation of the code. When the code is analyzed, PVS-Studio exhibits the report that comprises a set of warnings of various stage. Let’s look at one of many warning.
The next fragment is described within the article the place PVS-Studio checked LLVM 15.0 code:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
static ValueKnowledge meet(const ValueKnowledge &lhs,
const ValueKnowledge &rhs) |
PVS-Studio warning: V501 [CWE-570] There are an identical sub-expressions to the left and to the precise of the ‘||’ operator: !rhs ||!rhs ShapeUtils.h 141
The rhs object is checked twice, and the lhs object will not be checked in any respect. The standard rush when writing code and the shortage of thorough code evaluation after that.
The instance exhibits that PVS-Studio may even detect errors in compilers! There was just one instance, nonetheless, PVS-Studio has a big base of the errors that it has detected in numerous fashionable tasks like Qt, CMake, UE4, Chromium.
The PVS-Studio Methodology
The instrument makes use of a mixture of syntax parsing, information circulation evaluation, taint evaluation, software program composition evaluation (SCA) and management circulation evaluation to look at the code and establish points. It supplies a variety of checks, together with code high quality evaluation, reminiscence errors detection, buffer overflow evaluation, and safety vulnerability detection. Detecting such points on the early stage of the event course of, it helps groups save time and assets that will in any other case be spent on bug fixes, and safety patches down the road.
Options
PVS-Studio supplies a variety of options to assist software program builders detect errors and potential vulnerabilities of their software program tasks. Listed here are a number of the most vital options:
- Programming Language Assist: PVS-Studio helps C, C++, C#, and Java programming languages. The instrument makes use of specialised algorithms, serving to to detect language-specific points. Apparently, every instrument is developed in particular programming language for which it performs evaluation.
- Detection of Code Points: It supplies a variety of checks to detect potential points within the code, together with coding requirements violations, reminiscence errors, buffer overflows, race circumstances, safety vulnerabilities, and efficiency points.
- Integration into Improvement and CI Instruments: The mixing permits builders to include code evaluation instruments into their current improvement workflows and obtain warnings about points. PVS-Studio integrates into a number of improvement instruments and Steady Integration instruments, together with Visible Studio, IntelliJ IDEA, Rider, Jenkins, Maven, Gradle, GitHub/GitLab, Azure DevOps, SonarQube, and others.
- Detailed Reporting: It supplies an in depth report of any points discovered within the code, together with the placement within the supply code and an outline of the issue. The instrument additionally supplies options for find out how to repair the difficulty and permits builders to filter the report primarily based on severity and different standards. It may well detect issues within the code primarily based on AUTOSAR (AUTomotive Open System ARchitecture), MISRA (Motor Trade Software program Reliability Affiliation), OWASP (The Open Worldwide Utility Safety Mission),
- Assist and Documentation: PVS-Studio supplies complete documentation and help for customers. The instrument has an in depth information base, and e-mail help, guaranteeing that builders can get assist once they want it.
Efficiency Analysis
This supply code evaluation instrument has a number of options that contribute to its efficiency, accuracy, and value. A number of the most vital performance-related options embrace:
- Incremental Evaluation: Incremental evaluation lets you analyze the modified code because the final evaluation. This function helps save time and assets by avoiding redundant code evaluation that has already been carried out.
- Multithreading: PVS-Studio helps multithreading, permitting it to research a number of recordsdata in parallel. This function helps pace up the evaluation course of, particularly for big codebases.
- The Mass Suppression Mode: You’ll be able to inform PVS-Studio to think about the warnings irrelevant to date (to postpone the technical debt for later), and to not present them anymore. To any extent further, PVS-Studio will subject warnings just for new or modified code. This function helps scale back the variety of false positives and focus the evaluation on points which are extra related.
- Distributed Construct Methods: To hurry up the evaluation, you should utilize a distributed construct system resembling Incredibuild. In addition to, you’ll be able to profit from utilizing each distributed evaluation and compiler name monitoring programs.
- Configuration Profiles: PVS-Studio supplies a number of configuration profiles that customers can select from, relying on the kind of venture they’re engaged on. Every profile is optimized for a particular kind of venture and features a set of checks which are most related for that kind of venture.
Case Research
PVS-Studio Improved Unreal Engine’s Code
The PVS-Studio instrument helped the Unreal Engine group enhance the standard of their C++ sport engine. The Unreal Engine group discovered that PVS-Studio detected beforehand unnoticed points. Additionally, the instrument supplied detailed reviews on every subject, together with the placement within the code and options for find out how to repair the difficulty. The Unreal Engine group evaluated probably the most helpful PVS-Studio options, together with the power to customise the checks carried out on the code, the power to combine into current improvement instruments, and the power to filter the evaluation outcomes primarily based on severity.
Conclusion
General, PVS-Studio is a dependable and efficient instrument for enhancing code high quality and decreasing the danger of crucial points in software program tasks. Its in depth set of options, coupled with its observe file of success in detecting points in real-world tasks, make it a helpful funding for any improvement group seeking to enhance the standard and reliability of their software program.
P.S. This text is sponsored by “PVS-Studio”. PVS-Studio supplies the readers with the one month license to judge the analyzer’s capabilities and examine personal tasks for bugs. Observe the hyperlink or activate the “mycplus” promocode on their web site.
Sources to get began with PVS-Studio
Picture by Freepik
