PVS-Studio is a static code analyzer for C, C++, C#, and Java that detects bugs and vulnerabilities. It supports various compilers and IDE plugins. It uses data flow analysis, symbolic execution, pattern matching, and other techniques to detect bugs like buffer overflows, leaks, dead code, and undefined behavior. Over 700 diagnostics are implemented to date across the supported languages. The analyzer produces warnings classified by standard taxonomies. Users can exclude files, suppress warnings, and integrate it with continuous integration systems. Support and documentation is provided through online and PDF references.

1. PVS-Studio features overview
Windows, Linux, macOS
C, C++, C#, Java
Phillip Khandeliants
khandeliants@viva64.com

2. Speaker
 Lead C++/C# developer in PVS-
Studio team
 Have been working in the
company since 2016
 Popularizing modern C++

3.  Static code analyzers for C, C++, C++/CLI, C++/CX,
C#, and Java on Windows, Linux and macOS;
 Supported compilers (C/C++): MSVC, GCC, Clang,
MingW, ARM GCC, ARM Clang, Keil ARM
Compiler 5/6, IAR C/C++ Compiler for ARM, TI
ARM CGT;
 Plugins for Visual Studio 2010-2019, Rider, IntelliJ
IDEA;
PVS-Studio infrastructure

4.  Compilation monitoring utility for performing
analysis independently of the IDE or build system
(C/C++ only);
 Suppress files: ability to view warnings only on
newly written code;
 Incremental analysis: automatic analysis of changed
files
PVS-Studio infrastructure

5.  Integration with TeamCity, Azure DevOps, Travis CI,
CircleCI, GitLab CI/CD, Jenkins, SonarQube, etc.
 PlogConverter utility to convert raw log to desirable
format
 BlameNotifier utility to distribute warnings by mail
PVS-Studio infrastructure

6.  C, C++ diagnostics : 510
 C# diagnostics : 153
 Java diagnostics : 82
By July 2020 we’ve implemented in PVS-Studio:

7.  Copy-paste errors
 Array index out of bounds
 Buffer overrun
 Memory/resource leaks
 Invalid operator precedence
 Dereferencing of nullable types
 Dead/unreachable code
 Use of uninitialized variables
 Undefined/unspecified behavior
 ….
What can be detected?

8. Great attention is paid to analyzer warnings:
 Warnings classification is supported according to:
 Common Weakness Enumeration (CWE)
 SEI CERT C Coding Standard
 SEI CERT C++ Coding Standard
 MISRA C, MISRA C++
 Detailed documentation in Russian and English:
 Online
 PDF

9. Diagnostic capabilities of PVS-Studio

10.  This error demonstrates greatly how DataFlow analysis works in
PVS-Studio
 This error was found using PVS-Studio in Chromium project
(Protocol Buffers)
 The analyzer issues two warnings:
 V547 Expression 'time.month <= kDaysInMonth[time.month] + 1' is always
true. time.cc 83
 V547 Expression 'time.month <= kDaysInMonth[time.month]' is always true.
time.cc 85
Data Flow analysis

11. static const int kDaysInMonth[13] = {
0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};
bool ValidateDateTime(const DateTime& time) {
if (time.year < 1 || time.year > 9999 ||
time.month < 1 || time.month > 12 ||
time.day < 1 || time.day > 31 ||
time.hour < 0 || time.hour > 23 ||
time.minute < 0 || time.minute > 59 ||
time.second < 0 || time.second > 59) {
return false;
}
if (time.month == 2 && IsLeapYear(time.year)) {
return time.month <= kDaysInMonth[time.month] + 1;
} else {
return time.month <= kDaysInMonth[time.month];
}
}

12. static const int kDaysInMonth[13] = {
0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};
bool ValidateDateTime(const DateTime& time) {
if (time.year < 1 || time.year > 9999 ||
time.month < 1 || time.month > 12 ||
time.day < 1 || time.day > 31 ||
time.hour < 0 || time.hour > 23 ||
time.minute < 0 || time.minute > 59 ||
time.second < 0 || time.second > 59) {
return false;
}
if (time.month == 2 && IsLeapYear(time.year)) {
return time.month <= kDaysInMonth[time.month] + 1;
} else {
return time.month <= kDaysInMonth[time.month];
}
}

13. static const int kDaysInMonth[13] = {
0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};
bool ValidateDateTime(const DateTime& time) {
if (time.year < 1 || time.year > 9999 ||
time.month < 1 || time.month > 12 ||
time.day < 1 || time.day > 31 ||
time.hour < 0 || time.hour > 23 ||
time.minute < 0 || time.minute > 59 ||
time.second < 0 || time.second > 59) {
return false;
}
if (time.month == 2 && IsLeapYear(time.year)) {
return time.month <= kDaysInMonth[time.month] + 1;
} else {
return time.month <= kDaysInMonth[time.month];
}
}

14. static const int kDaysInMonth[13] = {
0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};
bool ValidateDateTime(const DateTime& time) {
if (time.year < 1 || time.year > 9999 ||
time.month < 1 || time.month > 12 ||
time.day < 1 || time.day > 31 ||
time.hour < 0 || time.hour > 23 ||
time.minute < 0 || time.minute > 59 ||
time.second < 0 || time.second > 59) {
return false;
}
if (time.month == 2 && IsLeapYear(time.year)) {
return time.month <= kDaysInMonth[time.month] + 1;
} else {
return time.month <= kDaysInMonth[time.month];
}
} time.day

15. int x0 = ....; int x1 = ....;
int y0 = ....; int y1 = ....;
assert(x0 <= x1 && "....");
assert(y0 <= y1 && "....");
assert((x1 - x0) == (y1 - y0) && "....");
assert(x0 >= 0 && x0 < int(some_value) && "....");
assert(x1 >= 0 && x1 < int(some_value) && "...."); // x1 >= 0
assert(y0 >= 0 && y0 < int(some_value) && "...."); // y0 >= 0
assert(y1 >= 0 && y1 < int(some_value) && "...."); // y1 >= 0
Symbolic execution
V560 A part of conditional expression is always true.
V560 A part of conditional expression is always true.
V560 A part of conditional expression is always true.

16. Method/class annotations
Our team has annotated thousands of functions and classes, given in:
 standard C library
 standard С++ library
 WinAPI
 glibc (GNU C Library)
 Qt
 MFC
 and so on

17. void EnableFloatExceptions(....)
{
....
CONTEXT ctx;
memset(&ctx, sizeof(ctx), 0);
....
}
Method/class annotations
V575 The 'memset' function processes '0' elements. Inspect the third argument.
crythreadutil_win32.h 294
This error was found using PVS-Studio in CryEngine V project

18. static void FwdLockGlue_InitializeRoundKeys()
{
unsigned char keyEncryptionKey[KEY_SIZE];
....
memset(keyEncryptionKey, 0, KEY_SIZE); // Zero out key data.
}
Pattern-based matching analysis
V597 CWE-14 The compiler could delete the 'memset' function call, which is used to flush
'keyEncryptionKey' buffer. The memset_s() function should be used to erase the private data.
FwdLockGlue.c 102
This error was found using PVS-Studio in Android
project

19. Start using PVS-Studio

20.  For VS2010-2019: just install plugin and check your solution!
 For other cases you can capture compiler invocations and gather all needed
information for the analysis
Using PVS-Studio: quick start
Windows:
 C and C++ Compiler Monitoring UI tool
Linux/macOS
 pvs-studio-analyzer utility

21. Using PVS-Studio: mass suppression
 It can be difficult to start using static analysis in a large project
 It’s not clear what to do with warnings in old code
 We suggest a decision: hiding messages using suppress files

22. Using PVS-Studio: suppressing of false positives
 Various ways to suppress false positives in specific lines of code
 Suppression of false positives in macros
 Suppression of false positives using pvsconfig diagnostics
configuration files

23. Using PVS-Studio: excluding from analysis
 Possibility to exclude files from analysis by their name, directory or mask
 Interactive filtration of analysis results (log) in PVS-Studio window:
 by diagnostic code and warning level
 by the file name
 by including the word in the text of a diagnostic

24.  The most efficient way of fixing an error is to do it right after it
appeared in code
Using PVS-Studio: automatic analysis of files after
their recompilation

25. Using PVS-Studio: scalability
 Support of multicore and multiprocessor systems with configuration
of the number of utilized cores
 IncrediBuild support

26.  Running analysis from command line for
checking the whole project
 Saving and loading of analysis results
 Using of relative paths in report files
 Send mail notifications with
BlameNotifier utility
Using PVS-Studio: continuous integration

27.  Convenient online reference on all diagnostics
Using PVS-Studio: documentation

28.  We developed a plugin for importing analysis results into SonarQube
 Using of this plugin allows to add warnings found by PVS-Studio
analyzer to the warnings base of SonarQube server
Using PVS-Studio: SonarQube

29. Using PVS-Studio: SonarQube

30. Using PVS-Studio: SonarQube

31. Using PVS-Studio: HTML report

32.  Write to us: support@viva64.com
 Subscribe:
 Twitter: @Code_Analysis
 RSS: http://feeds.feedburner.com/viva64-blog-en
 Facebook: https://www.facebook.com/StaticCodeAnalyzer
 Telegram: https://t.me/pvsstudio_en
 Download PVS-Studio:
https://www.viva64.com/download_cpp_on_sea/
Thank you for attention!