PVS-Studio Blog

> Huh, don't think I've heard that commitment before. Do you mean that the GCC devs intend for -fanalyzer to (eventually?) guarantee catching all exploitable UB (which would be... ambitious, to say the least), or that -fanalyzer is a best-effort analysis? The docs currently state the latter more or less ("It is neither sound nor complete: it can have false positives and false negatives.") Both actually. Any UB exploits not catched by -fanalyzer would need to be disabled. However I can't find a reference to this, so maybe my memory is deceiving me. When writing Frama-C what I was thinking of was actually PVS-Studio (https://pvs-studio.com/), as this can also be used by students. It's also more of a standalone linter. >> It is up to the programmer to ensure that the lifetime of a `dependent` reference is contained within the lifetime of the corresponding `owned` reference. Yes, this is an escape hatch, when the pointer shenanigans can't be fully described. But I heard Rust also has those. If you want your program to be described by ownership semantics, you will make use of this less and less. > named lifetimes support I don't know enough Rust, but from what I read at https://doc.rust-lang.org/book/ch10-03-lifetime-syntax.html, yes it does. Specifying that the 'lifetime' of the return value corresponds to a parameter happens with the `returned` annotation. The cool thing in SPlint is that you can describe the lifetime of param1.foo.bar[0..42] . It also has several…

Not only an insightful post, but also a fair number of interesting comments. A couple of resources I found in the comments: * A short list of safety rules for C: https://en.wikipedia.org/wiki/The_Power_of_10:_Rules_for_Developing_Sa… * A much longer document, 42 rules for coding in C and C++: https://pvs-studio.com/en/blog/posts/cpp/0391/ Update: also, a 210-comment thread from 2018: https://news.ycombinator.com/item?id=18334476

Replying to myself to add some things I think are real boons to development: - https://pvs-studio.com/en/blog/posts/ - I don't code in C or C++ but I love to read these posts with the limited understanding that I possess - GitHub has another product which is good https://github.com/dependabot - similar in nature to Snyk, Renovate, etc. - there was an HN thread yesterday about govulncheck which looks pretty nice as a Go-known-vulnerability-in-your-dependencies checker - code review is invaluable - continuous integration and a build that passes and expands to cover new bug cases is really helpful

The author links to a much more detailed list of mistakes in comparison functions. It's worth reading: https://pvs-studio.com/en/blog/posts/cpp/0509/

> Both actually. That would be quite the surprise to me. Quite unfortunate that you can't find a source given what the -fanalyzer docs currently say. > Any UB exploits not catched by -fanalyzer would need to be disabled. I'd be curious as to the hypothetical performance impact of this, as well as the amount of work it'd take to make -fanalyzer reliable enough. > When writing Frama-C what I was thinking of was actually PVS-Studio (https://pvs-studio.com/), as this can also be used by students. It's also more of a standalone linter. Ah, that's quite different. > Yes, this is an escape hatch, when the pointer shenanigans can't be fully described. Ah, that's fair. Bit different than what Rust offers, but what you say makes sense. > But I heard Rust also has those. Sort of yes, sort of no. Rust has an escape hatch in `unsafe`, but it technically doesn't disable any checks - for example, the borrow checker will check the validity of references, bounds checks will continue to be inserted, etc. regardless of whether you're in an `unsafe` block or not. What it does instead is to give you the ability to perform `unsafe` operations, which for borrow checker-related shenanigans would typically involve dealing with pointers (to be specific, dereferencing them since some other pointer operations are considered safe) since the borrow checker doesn't check pointers. > I don't know enough Rust, but from what I read at https://doc.rust-lang.org/book/ch10-03-lifetime-syntax.html, yes…

There's also PVS-Studio. They also scan open source projects - see https://pvs-studio.com/en/blog/inspections/ It's hard to convince managers to spend money on static analysis tools (or any development tool). Unless your company just got bad publicity for a bug and your devs come to you and demonstrate that a certain static analysis tool would have flagged that particular piece of code, most managers would let the beancounter-facet dominate the decision making process.

Just look at this: https://pvs-studio.com/en/blog/posts/cpp/1129/ - 11 parts about C++ undefined behavior from people who specialize in finding this stuff. And that’s only the tip of the iceberg. I use C++ daily, and it’s an overcomplicated language. The really good thing about Rust or Zig is that (mostly) everything is explicit, and that’s a big win in my opinion. In defense of C++, I can only say that lots of interesting projects in the world are written in it.

What it means is that since i as the variable is monotonically increasing, an array indexing operation that is in the loop body can be replaced with an incrementing pointer instead, which eliminates quite a lot of code. An example here: https://pvs-studio.com/en/blog/posts/cpp/0374/

That's a bad coding style document. There's no rationale given, except for a bunch of references at the top, which are clearly argument from authority. I think the no "loop initial declarations" is for consistency with "all declarations at the top". Other coding style guides favor "declarations as close as possible to first use", including guidelines for mission critical systems (if you resort to argument from authority I have some too...) [1]. As much as I like Suckless, this section is just pet peeves that can safely be ignored; unless you submit a patch to a project that aligns with it. [1] https://pvs-studio.com/en/docs/warnings/v2551/

> the footguns in C++ are more benign I don't think I can agree. https://pvs-studio.com/en/blog/posts/cpp/1215/

30 years of DOOM: new code, new bugs - https://pvs-studio.com/en/blog/posts/cpp/1087/

To avoid Medium and have more tips: https://pvs-studio.com/en/blog/posts/cpp/1053/

I wonder if PVS would flag those issues. (https://pvs-studio.com/en/) I expect it to flag the atoi, but not sure about the pop.

So I want to add an explanation. As I see from the comments, many of you thought that the PVS-Studio analyzer warns about a function's unused argument. That's not quite so. Or, to be precise, this is so, but the analyzer processes this case smarter than most linters or compilers. It's a bad idea to program an analyzer so that it just issues a warning to unused arguments. Such analyzer would produce many false positives, which is why many developers don't look at (or disable) these warnings in their compilers/analyzers. The PVS-Studio analyzer implements sort of empirical "magic". PVS-Studio relies on the fact that there are arguments of the same type and some of them are not used, while the other ones are used several times. At the same time, there are a number of exceptions to the rule. For example, the diagnostic is not triggered if the number of unused arguments exceeds two. All this allows the V751 diagnostic to issue few false positives, which makes the tool surpass its competitors. To be exact, when developing PVS-Studio, we do not implement rules if we cannot make them better than those of the compilers - https://pvs-studio.com/en/blog/posts/0802/ . Thanks to the diagnostic I described above, one can find interesting errors - https://pvs-studio.com/en/blog/examples/v751/ . P.S. The PVS-Studio analyzer also provides a "stupid" version of this diagnostic - V2537 https://pvs-studio.com/en/docs/warnings/v2537/ . It was developed to check code against MISRA C and MISRA…