PVS-Studio Blog

Here are the results for cry engine specifically: https://www.viva64.com/en/b/0417/ https://www.viva64.com/en/b/0495/ https://www.viva64.com/en/b/0574/ I'm not endorsing pvs studio nor am I saying it's bad. Try out some tools and see what works best for you.

The best answer to "Rust hype" I've ever seen. https://www.viva64.com/en/b/0324/

Continue The Evil within the Comparison Functions - https://www.viva64.com/en/b/0509/ Annotation. Perhaps, readers remember my article titled "Last line effect". It describes a pattern I've once noticed: in most cases programmers make an error in the last line of similar text blocks. Now I want to tell you about a new interesting observation. It turns out that programmers tend to make mistakes in functions comparing two objects. This statement looks implausible; however, I'll show you a great number of examples of errors that may be shocking to a reader. So, here is a new research, it will be quite amusing and scary.

It isn't hidden, really. I followed the hyperlink at the top to the main page of the site, and the bullet-point list that you are responding to is right there, on that very first page. It is under a heading entitled Main Features of PVS-Studio. * https://www.viva64.com/en/pvs-studio/

The site also mentions bugs found in open source projects using PVS-Studio [0]. The ones found in GCC [1] are particularly noteworthy. [0] http://www.viva64.com/en/examples/ [1] http://www.viva64.com/en/b/0425/

So far I'm impressed by every demonstration of PVS Studio that gets linked here and I love the developer's way of using open source projects for demonstrations (and thereby improving these projects). Great job. Unfortunately the software seems to have no single developer license (only 'Team' and 'Site') and you have to write them a mail to even get a quote [1]? In other words: Awesome tool, completely unavailable and out of reach for me. Are there any somewhat comparable tools in the C# world that you use in your projects, apart from StyleCop/FxCop? 1: http://www.viva64.com/en/order/ - "Please write us from your corporate e-mail address for details on PVS-Studio prices. Specify information about your company and the type of license you would like to purchase (see the table below)."

Yes. PVS-Studio confesses its love for Linux: http://www.viva64.com/en/b/0415/

The article is just a really short recommendation to check out Karpov's full book at this page: http://www.viva64.com/en/b/0391/ So, I'd say it would probably be a good idea to change the submission directly to that URL. The information at the viva64 link looks really good, but the visualstudiomagazine article doesn't really add any additional information besides "Check out this link, it's great"

Nice paper from 2013, but I was confused at first how it related to the blog. This paragraph just after the abstract explained, but I missed it the first time through: The original article in PDF[1] was published at the NCSU COE People site. It was translated and published at our blog by the authors' permission. At the end of the article[2], we added a short section about the PVS-Studio analyzer, where we describe which of the recommendations suggested in the article are or aren't implemented in our tool and why. [1] http://people.engr.ncsu.edu/ermurph3/papers/icse13b.pdf [2] http://www.viva64.com/en/b/0335/#ID0EU4CK

For those lacking context, these remarks from Graydon are likely a response to the following post which has been trending today, though it didn't get much traction on HN: http://www.viva64.com/en/b/0324/ (with some comments at https://www.reddit.com/r/rust/comments/35pn5a/criticizing_the_rust_lan…

The intended use case is people trying to write realtime systems - that is, systems with a latency guarantee, like antilock brakes or flight control systems - in UNIX. However, no sensible person would write such a thing in a general-purpose multi-user operating system. Realtime is hard, see the Toyota mess: http://www.viva64.com/en/a/0083/ "Move fast and break things" is not a great motto for automotive control software.

Who cares. It's finding and reporting genuine bugs in widely used open source libraries, and most of the times it's even suggesting a fix or a workaround. Think about it: each article is worth half a dozen to a dozen high quality bug reports. Moreover, the guys behind PVS-Studio seem like great guys. The CTO, Andrey Karpov, was interviewed in early 2014: http://www.viva64.com/en/b/0231/. Selling software development tools isn't easy. PVS-Studio "adverts" are interesting and useful to the community.

One thing article does not mention is the false positives. Filter helps only partially, i'm still left with hundreds of false positives. PVS-Studio considers false-positives as natural part of the progress. A total turn-off me. Cppcheck does very well in that regard, i only have 2 false positives with cppcheck. Best part is they are considered bugs by cppcheck team. Also wonder about the opposite, errors that have been caught by cppcheck but ignored by PVS-Studio. They do exist. http://www.viva64.com/en/b/0149/ My points are: - Every c++ project should use cppcecheck since it has almost no noise. - PVS-Studio if you have a dedicated analyst in your team and able to pony up $10k per year.

I would say that the best economic value is being delivered if we consider some code fragments that are almost never covered by tests (any of them) - like error detector. Guys at pvs-studio brought in some pretty funny example of such errors: http://www.viva64.com/en/a/0078/

Yes, PVS-Studio is very good and useful for avoiding bugs. No, companies don't really care about avoiding bugs. No one at Samsung will risk delaying the release of the next plastic crap product by fixing any problems. Why would they? Defects will even encourage customers to buy a new device because they are used to getting no bug fix updates. This is the worst possible company for Viva64 to go to. It seems like C++ developers either don't give a shit about code quality or they do, and don't make many mistakes anymore. Either way there is little demand for a static analyzer. It won't get easier for Viva64 in the future. A few years ago, Compilers and IDEs started providing similar warnings as PVS-Studio, although not quite as sophisticated yet. Code-level testing begins to be a thing in proprietary software. Clang offers valgrind-like sanitizers for different classes of bugs that even PVS-Studio cannot detect. TIL that Viva64 has over 20 employees. The passive-aggressive blog posts always made it look like one or two people running PVS-Studio as a side project or so. I read those posts regularly, but I don't remember them announcing any new features or improvements in PVS-Studio itself. Why do I have to pay annually if they don't spend the money on improving the product? I am not even sure if PVS-Studio is worth the money. They don't have prices on the web site and defend their business decisions in the FAQ (https://www.viva64.com/en/order-faq/) in a very unprofessional…

I just love this one: http://www.viva64.com/en/examples/V504/ void GlyphComboBox::update(SPFont* spfont) { if (!spfont) return // <= //TODO: figure out why do we need to append("") // before clearing items properly... //Gtk is refusing to clear the combobox //when I comment out this line this->append(""); this->remove_all(); } Gee, why do you need the dummy append? It's because you put in so many TODO comments that you concealed the missing semicolon that you otherwise might have found ... This is arguably not a bug; the developer tested the code, massaged it into working as expected, using what look like well-defined constructs, and documented their surprise at certain aspects of the code, leaving this issue easy to find with a grep for TODO. On another note, what is surprising here is that they didn't catch it with their compiler. Look, the function returns void. GCC has a diagnostic for this, something like "return with expression in a function returning void". I think that still kicks in even if that expression has void type.

Having done similar work for Chrome, I can attest to the fact that large code bases are full of errors. If you're not on Windows, using both gcc's -Wall and -Wextra along with Clang in the same way is a good start. (Here's a post with more details: http://neugierig.org/software/chromium/notes/2011/01/clang.html .) The Clang static analyzer wasn't very useful at the time I tried it because it didn't analyze C++ code. Valgrind also finds a lot but it is harder to be diligent about fixing. The PVS Studio guy (mentioned in Carmack's post) ran our code through it as well and also found a number of bugs, as described in a few posts: http://www.viva64.com/en/a/0074/ http://www.viva64.com/en/b/0113/ . (As Carmack supposed, they also claimed the Chrome code was some of the best they'd seen. But it's more likely they were being truthful in both cases.) They've also ran the Chrome code through Coverity, but I haven't been involved in fixing those bugs so I don't know how useful it was. Searching the bug tracker for [coverity] turns up a handful of bugs, but it's possible more are hidden for security reasons.

C/C++ developers not knowing the rules does bite them. For example, it made the 32-bit/64-bit transition much more painful. See https://www.viva64.com/en/a/0004/ ; https://www.viva64.com/en/a/0065/

It's a (commercial) static code analyzer: https://www.viva64.com/en/pvs-studio/ You could probably make a comparison between it and Clang-Analyzer (however, we've found in practice that PVS Studio gives much, much fewer false positive results.)

Is this page just stealing content from PVS-Studio's official blog? https://www.viva64.com/en/b/0615/

I don't know why this website has copied the blog text from another site, but if you want to read the article on the original site, go to https://www.viva64.com/en/b/0619/

This seems like a stolen article. The URL should be changed to the original blog post: https://www.viva64.com/en/b/0615/

Type conversions, even non lossy ones, can teach people to use the wrong type, in c++ it's very common to see people use a int in a for loop indexing an array when you should always use size_t for that purpose. This misuse is so widespread that people hardly even know that the size_t type exists. https://www.viva64.com/en/a/0050/ has some nice material about why this matters and the type of bugs this can cause.

https://youtu.be/gp_D8r-2hwk?t=50 A space error: 370.000.000 $ for an integer overflow https://www.viva64.com/en/b/0426/

Since the landing page mentions "semantic analysis" and based on the BAD_MIN_MAX_FUNC example in another comment, I think this is mostly focusing on logic errors that would pass a type checker/compiler without problem but show incorrect behavior at runtime. A similar product would be PVS-Studio https://www.viva64.com/en/pvs-studio/ (I haven't used it, but their articles occasionally get posted to HN.)

I agree it shouldn’t happen, but in this case, the programmer presumably made (more or less) the same mistake, writing out a variable called password unencrypted, possibly after copying it to a variable or structure field called passwordhint. Thinking of that, this may be an example of a copy-paste bug (https://www.viva64.com/en/a/0068/), where the programmer wrote strcpy(&r.password , &encryptedpassword); strcpy(&r.passwordhint, &password); instead of strcpy(&r.password , &encryptedpassword); strcpy(&r.passwordhint, &passwordhint); (Hopefully using the safer strncpy, but that’s orthogonal to this argument)

Here's is a good summary of possible issues porting 32-bit C++ code to 64-bit from PVS-Studio developers. https://www.viva64.com/en/a/0004/

> Coverity is expensive and majority of software people use are open-source which don't make use of it(hence all the CVEs). It's definitely an area where the closed source tools are ahead of the OSS alternatives, but there are open source (and free closed source) alternatives to Coverity. PVS Studio, for example, has a free download: https://www.viva64.com/en/pvs-studio/ > As an end user running a server, i very much care about whether my web server has vulnerabilities. And the promise about safety is not vague, it has clearly defined semantics. You say that, yet you're still running a ton of software written in C and C++.

I think this is a very objective and in-depth article on the matter. "Criticizing the Rust Language, and Why C/C++ Will Never Die" https://www.viva64.com/en/b/0324/ Not sure why certain members of the Rust community aren't happy with just having a neat language. Making one false claim after another isn't doing them any favors. It's just aggravating, especially when people who should know better start to believe the hype. FAKE NEWS!

>The title is very misleading. I agree the title originally as submitted[1] is not helpful. When the author submitted[2] it to Intel DZ, he re-used the same vague title as the original PVS-Studio article from April 2016: http://www.viva64.com/en/b/0391/ HN admins already edit titles with [YEAR] to signify an old article. In the same vein, I do wish the admins (or the original submitters to save the admins the effort) went even further and exercised editorial judgement to add [NON-CUTE SUBTITLE] to negate the effects of cute-but-meaningless titles. In this case, there would be a "[C/C++ refactoring tips]" like you suggested appended to the end of the title. [1] original submitted HN title: "The Ultimate Question of Programming, Refactoring, and Everything" [2] https://software.intel.com/en-us/articles/how-to-contribute-to-intel-d…