A Evaluation of Static Code Analyzer – PVS-Studio

[ad_1]

PVS-Studio is a industrial static code analyzer developed by PVS-Studio LLC. It’s designed to assist software program builders detect errors and potential vulnerabilities of their code by analyzing it with out really working it. The device helps a number of programming languages: C, C++, C#, and Java. This makes it a flexible choice for groups engaged on initiatives with totally different language necessities.

Desk of Contents

How PVS-Studio works

PVS-Studio has a set of diagnostic guidelines that assist builders to detect errors in addition to to look at the error and repair it. After PVS-Studio is built-in into an IDE, it runs the evaluation of the code. When the code is analyzed, PVS-Studio reveals the report that incorporates a set of warnings of various stage. Let’s study one of many warning.

The next fragment is described within the article the place PVS-Studio checked LLVM 15.0 code:

static ValueKnowledge meet(const ValueKnowledge &lhs,</p> <p> const ValueKnowledge &rhs)

static ValueKnowledge meet(const ValueKnowledge &lhs,

const ValueKnowledge &rhs) !rhs

PVS-Studio warning: V501 [CWE-570] There are an identical sub-expressions to the left and to the best of the ‘||’ operator: !rhs ||!rhs ShapeUtils.h 141

The rhs object is checked twice, and the lhs object isn’t checked in any respect. The same old rush when writing code and the dearth of thorough code evaluation after that.

The instance reveals that PVS-Studio may even detect errors in compilers! There was just one instance, nevertheless, PVS-Studio has a big base of the errors that it has detected in numerous fashionable initiatives like Qt, CMake, UE4, Chromium.

The PVS-Studio Methodology

The device makes use of a mixture of syntax parsing, information stream evaluation, taint evaluation, software program composition evaluation (SCA) and management stream evaluation to look at the code and determine points. It offers a variety of checks, together with code high quality evaluation, reminiscence errors detection, buffer overflow evaluation, and safety vulnerability detection. Detecting such points on the early stage of the event course of, it helps groups save time and sources that will in any other case be spent on bug fixes, and safety patches down the road.

Options

PVS-Studio offers a variety of options to assist software program builders detect errors and potential vulnerabilities of their software program initiatives. Listed below are among the most necessary options:

Programming Language Help: PVS-Studio helps C, C++, C#, and Java programming languages. The device makes use of specialised algorithms, serving to to detect language-specific points. Curiously, every device is developed in particular programming language for which it performs evaluation.

Detection of Code Points: It offers a variety of checks to detect potential points within the code, together with coding requirements violations, reminiscence errors, buffer overflows, race situations, safety vulnerabilities, and efficiency points.

Integration into Growth and CI Instruments: The combination permits builders to include code evaluation instruments into their current growth workflows and obtain warnings about points. PVS-Studio integrates into a number of growth instruments and Steady Integration instruments, together with Visible Studio, IntelliJ IDEA, Rider, Jenkins, Maven, Gradle, GitHub/GitLab, Azure DevOps, SonarQube, and others.

Detailed Reporting: It offers an in depth report of any points discovered within the code, together with the placement within the supply code and an outline of the issue. The device additionally offers solutions for how one can repair the problem and permits builders to filter the report based mostly on severity and different standards. It will possibly detect issues within the code based mostly on AUTOSAR (AUTomotive Open System ARchitecture), MISRA (Motor Trade Software program Reliability Affiliation), OWASP (The Open Worldwide Utility Safety Venture),
Help and Documentation: PVS-Studio offers complete documentation and help for customers. The device has an in depth information base, and e mail help, guaranteeing that builders can get assist once they want it.

Efficiency Analysis

This supply code evaluation device has a number of options that contribute to its efficiency, accuracy, and value. A number of the most necessary performance-related options embrace:

Incremental Evaluation: Incremental evaluation means that you can analyze the modified code because the final evaluation. This characteristic helps save time and sources by avoiding redundant code evaluation that has already been carried out.
Multithreading: PVS-Studio helps multithreading, permitting it to research a number of information in parallel. This characteristic helps velocity up the evaluation course of, particularly for big codebases.
The Mass Suppression Mode: You may inform PVS-Studio to think about the warnings irrelevant thus far (to postpone the technical debt for later), and to not present them anymore. To any extent further, PVS-Studio will problem warnings just for new or modified code. This characteristic helps cut back the variety of false positives and focus the evaluation on points which can be extra related.
Distributed Construct Methods: To hurry up the evaluation, you need to use a distributed construct system similar to Incredibuild. Apart from, you may profit from utilizing each distributed evaluation and compiler name monitoring techniques.
Configuration Profiles: PVS-Studio offers a number of configuration profiles that customers can select from, relying on the kind of mission they’re engaged on. Every profile is optimized for a selected kind of mission and features a set of checks which can be most related for that kind of mission.

Case Examine

PVS-Studio Improved Unreal Engine’s Code

The PVS-Studio device helped the Unreal Engine workforce enhance the standard of their C++ sport engine. The Unreal Engine workforce discovered that PVS-Studio detected beforehand unnoticed points. Additionally, the device supplied detailed reviews on every problem, together with the placement within the code and solutions for how one can repair the problem. The Unreal Engine workforce evaluated essentially the most helpful PVS-Studio options, together with the flexibility to customise the checks carried out on the code, the flexibility to combine into current growth instruments, and the flexibility to filter the evaluation outcomes based mostly on severity.

Conclusion

Total, PVS-Studio is a dependable and efficient device for enhancing code high quality and lowering the danger of vital points in software program initiatives. Its intensive set of options, coupled with its observe file of success in detecting points in real-world initiatives, make it a beneficial funding for any growth workforce trying to enhance the standard and reliability of their software program.

P.S. This text is sponsored by “PVS-Studio”. PVS-Studio offers the readers with the one month license to guage the analyzer’s capabilities and test personal initiatives for bugs. Observe the hyperlink or activate the “mycplus” promocode on their web site.