PVS-Studio is a commercial static code analyzer developed by PVS-Studio LLC. It is designed to help software developers detect errors and potential vulnerabilities in their code by analyzing it without actually running it. The tool supports several programming languages: C, C++, C#, and Java. This makes it a versatile option for teams working on projects with different language requirements.
Table of Contents
- How PVS-Studio works
- The PVS-Studio Methodology
- Features
- Performance Evaluation
- Case Study
- Conclusion
- Resources to get started with PVS-Studio
How PVS-Studio works
PVS-Studio has a set of diagnostic rules that help developers to detect errors as well as to examine the error and fix it. After PVS-Studio is integrated into an IDE, it runs the analysis of the code. When the code is analyzed, PVS-Studio shows the report that contains a set of warnings of different level. Let’s examine one of the warning.
The following fragment is described in the article where PVS-Studio checked LLVM 15.0 code:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | static ValueKnowledge meet(const ValueKnowledge &lhs, const ValueKnowledge &rhs) { ValueKnowledge result = getPessimisticValueState(); result.hasError = true; if (!rhs || !rhs || lhs.dtype != rhs.dtype) // <= return result; result.hasError = false; result.dtype = lhs.dtype; .... } |
PVS-Studio warning: V501 [CWE-570] There are identical sub-expressions to the left and to the right of the ‘||’ operator: !rhs ||!rhs ShapeUtils.h 141
The rhs object is checked twice, and the lhs object is not checked at all. The usual rush when writing code and the lack of thorough code review after that.
The example shows that PVS-Studio can even detect errors in compilers! There was only one example, however, PVS-Studio has a large base of the errors that it has detected in various popular projects like Qt, CMake, UE4, Chromium.
The PVS-Studio Methodology
The tool uses a combination of syntax parsing, data flow analysis, taint analysis, software composition analysis (SCA) and control flow analysis to examine the code and identify issues. It provides a wide range of checks, including code quality analysis, memory errors detection, buffer overflow analysis, and security vulnerability detection. Detecting such issues at the early stage of the development process, it helps teams save time and resources that would otherwise be spent on bug fixes, and security patches down the line.
Features
PVS-Studio provides a wide range of features to help software developers detect errors and potential vulnerabilities in their software projects. Here are some of the most important features:
- Programming Language Support: PVS-Studio supports C, C++, C#, and Java programming languages. The tool uses specialized algorithms, helping to detect language-specific issues. Interestingly, each tool is developed in specific programming language for which it performs analysis.
- Detection of Code Issues: It provides a wide range of checks to detect potential issues in the code, including coding standards violations, memory errors, buffer overflows, race conditions, security vulnerabilities, and performance issues.
- Integration into Development and CI Tools: The integration allows developers to incorporate code analysis tools into their existing development workflows and receive warnings about issues. PVS-Studio integrates into several development tools and Continuous Integration tools, including Visual Studio, IntelliJ IDEA, Rider, Jenkins, Maven, Gradle, GitHub/GitLab, Azure DevOps, SonarQube, and others.
- Detailed Reporting: It provides a detailed report of any issues found in the code, including the location in the source code and a description of the problem. The tool also provides suggestions for how to fix the issue and allows developers to filter the report based on severity and other criteria. It can detect problems in the code based on AUTOSAR (AUTomotive Open System ARchitecture), MISRA (Motor Industry Software Reliability Association), OWASP (The Open Worldwide Application Security Project),
- Support and Documentation: PVS-Studio provides comprehensive documentation and support for users. The tool has an extensive knowledge base, and email support, ensuring that developers can get help when they need it.
Performance Evaluation
This source code analysis tool has several features that contribute to its performance, accuracy, and usability. Some of the most important performance-related features include:
- Incremental Analysis: Incremental analysis allows you to analyze the modified code since the last analysis. This feature helps save time and resources by avoiding redundant code analysis that has already been performed.
- Multithreading: PVS-Studio supports multithreading, allowing it to analyze multiple files in parallel. This feature helps speed up the analysis process, especially for large codebases.
- The Mass Suppression Mode: You can tell PVS-Studio to consider the warnings irrelevant so far (to postpone the technical debt for later), and not to show them anymore. From now on, PVS-Studio will issue warnings only for new or modified code. This feature helps reduce the number of false positives and focus the analysis on issues that are more relevant.
- Distributed Build Systems: To speed up the analysis, you can use a distributed build system such as Incredibuild. Besides, you can benefit from using both distributed analysis and compiler call monitoring systems.
- Configuration Profiles: PVS-Studio provides several configuration profiles that users can choose from, depending on the type of project they are working on. Each profile is optimized for a specific type of project and includes a set of checks that are most relevant for that type of project.
Case Study
PVS-Studio Improved Unreal Engine’s Code
The PVS-Studio tool helped the Unreal Engine team improve the quality of their C++ game engine. The Unreal Engine team found that PVS-Studio detected previously unnoticed issues. Also, the tool provided detailed reports on each issue, including the location in the code and suggestions for how to fix the issue. The Unreal Engine team evaluated the most useful PVS-Studio features, including the ability to customize the checks performed on the code, the ability to integrate into existing development tools, and the ability to filter the analysis results based on severity.
Conclusion
Overall, PVS-Studio is a reliable and effective tool for improving code quality and reducing the risk of critical issues in software projects. Its extensive set of features, coupled with its track record of success in detecting issues in real-world projects, make it a valuable investment for any development team looking to improve the quality and reliability of their software.
P.S. This article is sponsored by “PVS-Studio”. PVS-Studio provides the readers with the one month license to evaluate the analyzer’s capabilities and check own projects for bugs. Follow the link or activate the “mycplus” promocode on their website.
Resources to get started with PVS-Studio
- PVS-Studio Documentation: https://pvs-studio.com/en/docs/
- List of errors it can detect: https://pvs-studio.com/en/blog/examples/
- The Cherno “Static Analysis in C++”: https://youtu.be/vYW6TOwFK2M
- CodeBeauty “How to detect errors and bugs in code? Explaining Memory Leaks in C++”: https://youtu.be/AeyTSLGIX1M
- How I improved my Legacy C++ Code: https://www.cppstories.com/2020/09/pvs-studio-checking.html/
Image by Freepik
