PVS-Studio. Static code analyzer. Windows/Linux, C/C++/C#. 2017

PVS-Studio OOO "Program Verification Systems" Website: http://www.viva64.com. Contacts: support@viva64.com Static code analyzer Windows/Linux, C/C++/C# 2017

PVS-Studio static code analyzer • Performs code analysis in C, C++, C++/CLI, C++/CX, C# • Supports projects, developed with: • Windows: Visual C++, Clang, MinGW, Visual C# • Linux: Clang, GCC • Plugin for Visual Studio 2010-2015 • Integration with SonarQube, QtCreator, CLion, Eclipse CDT, Anjuta DevStudio and so on. • Standalone utility

January, 2017: PVS-Studio has • C, C++ diagnostics: 349 • C # diagnostics: 130 • Detailed on-line documentation in Russian and English • PDF

Main features • Quick Start (compilation monitoring) • Windows utility: CLMonitoring • Linux utility: pvs-studio-analyzer • Direct integration of the analyzer into the systems of build automation and the BlameNotifier utility (e-mail notification) • Automatic analysis of modified files • Great scalability • Working with false alarms

Why do people need code analyzers? Why did PVS-Studio team choose C, C++ and C#?

Why C and C++? • These are effective but sophisticated languages where it is easy to make a mistake • It has been for ages like that and is unlikely to change • Let’s check with PVS-Studio the first version of the Cfront compiler, released in 1985. • “Celebrating the 30-th anniversary of the first C++ compiler: let’s find the bugs in it.” http://www.viva64.com/en/b/0355/

A bug in the Cfront compiler (1985): Pexpr expr::typ(Ptable tbl) { .... Pclass cl; .... cl = (Pclass) nn->tp; cl->permanent=1; if (cl == 0) error('i',"%k %s'sT missing",CLASS,s); First, the pointer is dereferenced. Then there is a check, saying that the pointer could be nullptr.

30 years passed. • Nothing has changed. The C++ language is still complicated and dangerous. • The size of the code base increases and it gets more and more important to use static code analysis tools • Let’s check the code of modern Clang compiler with PVS-Studio • 2016 . “Finding bugs in the code of LLVM project with the help of PVS- Studio”. http://www.viva64.com/en/b/0446/

Clang (the bug was found in October, 2016) bool PPCDarwinAsmPrinter::doFinalization(Module &M) { .... MachineModuleInfoMachO &MMIMacho = MMI->getObjFileInfo<MachineModuleInfoMachO>(); if (MAI->doesSupportExceptionHandling() && MMI) { First, the pointer is dereferenced. Then there is a check, saying that the pointer could be nullptr.

Why C #? • Perhaps, the situation in C# is slightly better? • Some types of errors in are impossible in C# • So it's better, but not much • Still, there are typos, logical errors, etc • Also, in C# the pointers are now called references, but it didn’t really help. • We see the same error in the null reference • Let’s now check Microsoft PowerShell project:http://www.viva64.com/en/b/0447/

These bugs are relevant for C# too public CommandMetadata(CommandMetadata other) { .... _parameters = new Dictionary<string, ParameterMetadata>( other.Parameters.Count, .....); if (other.Parameters != null) An error in the PowerShell project: first the reference is used, and then checked.

We can show a huge list of examples like these • PVS-Studio analyzer easily finds bugs in popular projects: • Linux kernel - http://www.viva64.com/en/b/0460/ • GCC - http://www.viva64.com/en/b/0425/ • MSBuild - http://www.viva64.com/en/b/0424/ • Qt - http://www.viva64.com/en/b/0424/ • And so on - http://www.viva64.com/en/inspections/ • This shows the demand in static code analysis • Let’s see what bugs PVS-Studio is able to find

Diagnostic abilities of PVS-Studio

Error related to porting the code to 64-bit platforms This bug was found in TortoiseSVN DialogBoxParam(g_hmodThisDll, MAKEINTRESOURCE(IDD_LOGIN), g_hwndMain, (DLGPROC)(LoginDialogProc), (long)this); V220 Suspicious sequence of types castings: memsize -> 32-bit integer -> memsize. The value being casted: 'this'. logindialog.cpp 105 Note. The long type is still 32 bit in Win64. In the 64-bit program an object can be created outside the lower 4 Gigabytes of memory. In this case, the pointer value will be ruined. Quite a nasty bug, that may show up very rarely after long operation of the program. Correct: (LPARAM)(this).

The address of the local variable is returned from the function by the reference This bug was found in LLVM by PVS-Studio V558 Function returns the reference to temporary local object: res. LiveInterval.h 679 SingleLinkedListIterator<T> &operator++(int) { SingleLinkedListIterator res = *this; ++*this; return res; }

Arithmetic overflow, underflow This bug was found in OpenXRay V636 The '1 / 100' expression was implicitly cast from 'int' type to 'float' type. Consider utilizing an explicit type cast to avoid the loss of a fractional part. An example: double A = (double)(X) / Y;. gl_rendertarget.cpp 245 float CRenderTarget::im_noise_time; .... param_noise_fps = 25.f; param_noise_scale = 1.f; im_noise_time = 1/100; ....

Array index out of bounds This bug was found in Notepad++ V557 Array overrun is possible. The value of 'i' index could reach 46. Notepad++ preferencedlg.cpp 984 int encodings[] = {1250, 1251, 1252, .... }; for (int i = 0; i <= sizeof(encodings)/sizeof(int); i++) { int cmdID = em->getIndexFromEncoding(encodings[i]); .... }

Dead code This bug was found in Unreal Engine 4 V607 Ownerless expression 'NumByteProperties'. codegenerator.cpp 633 int32 NumByteProperties = 0; .... if (bIsByteProperty) { NumByteProperties; }

Unreachable code This bug was found in Linux Kernel V695 Range intersections are possible within conditional expressions. Example: if (A < 5) { ... } else if (A < 2) { ... }. Check lines: 439, 441. ad5933.c 441 if (val > 511) val = (val >> 1) | (1 << 9); else if (val > 1022) val = (val >> 2) | (3 << 9);

Uninitialized variables This bug was found in Mono V3070 Uninitialized variable 'schema' is used when initializing the 'ResourceSchema' variable. ResXResourceWriter.cs 59 class ResXResourceWriter : IResourceWriter, IDisposable { public static readonly string ResourceSchema = schema; .... static string schema = ....; } Note. At the moment of the ResourceSchema initialization, the field schema will be initialized by the default value (in this case - null).

Unused variables and arguments This bug was found in Xenko V3065 Parameter 'height' is not utilized inside method's body. SiliconStudio.Xenko Image.cs 473 public static Image New3D(int width, int height, int depth, ....) { return new Image( CreateDescription( TextureDimension.Texture3D, width, width, depth, mipMapCount, format, 1), dataPointer, 0, null, false); }

Incorrect shift operations This bug was found in Bitcoin V629 Consider inspecting the '0x80 << (8 * (vch.size() - 1))' expression. Bit shifting of the 32-bit value with a subsequent expansion to the 64-bit type. script.h 169 Note. Stack overflow occurs upon the shift of a 32-bit value 0x80. The corrected version of the code now looks like this: static int64_t set_vch(....) { int64_t result = 0; .... return -(result & ~(0x80 << (8 * (vch.size() - 1)))); return -((int64_t)(result & ~(0x80ULL << (8 * (vch.size() - 1)))));

Undefined behavior This bug was found in Network Security Services V567 Undefined behavior. The 'j' variable is modified while being used twice between sequence points. pk11slot.c 1926 waste[j & 0xf] = j++;

Incorrect work with types This bug was found in VirtualBox V745 A 'wchar_t *' type string is incorrectly converted to 'BSTR' type string. Consider using 'SysAllocString' function. vboxcredentialprovider.cpp 231 HRESULT EventClassID(BSTR bstrEventClassID); static HRESULT VBoxCredentialProviderRegisterSENS(void) { hr = pIEventSubscription->put_EventClassID( L"{d5978630-5b9f-11d1-8dd2-00aa004abd5e}");

Misconceptions about the work of a function/class This bug was found in Unity3D V3057 Invalid regular expression patern in constructor. Inspect the first argument. AssetBundleDemo ExecuteInternalMono.cs 48 private static readonly Regex UnsafeCharsWindows = new Regex("[^A-Za-z0-9_-.:,/@]"); Note. Upon the attempt to create an instance of a Regex class with this pattern we will get an exception System.ArgumentException with a message: parsing "[^A-Za-z0-9_-.:,/@]" - Unrecognized escape sequence '_'.

Absence of a virtual destructor All the examples are quite long and it’s too hard to fit them in one presentation. Believe me, we are able to find such issues. For now I suggest making a cup of coffee. We still have a lot to cover.

The code formatting, not corresponding with the logic of its work This bug was found in Sony ATF V3043 The code's operational logic does not correspond with its formatting. The statement is indented to the right, but it is always executed. It is possible that curly brackets are missing. Atf.Core.vs2010 QuatF.cs 282 public static QuatF Slerp(QuatF q1, QuatF q2, float t) { double dot = q2.X * q1.X + q2.Y * q1.Y + q2.Z * q1.Z + q2.W * q1.W; if (dot < 0) q1.X = -q1.X; q1.Y = -q1.Y; q1.Z = -q1.Z; q1.W = -q1.W;

Exception handling errors This bug was found in OpenMW V596 The object was created but it is not being used. The 'throw' keyword could be missing: throw logic_error(FOO); components exprparser.cpp 101 if (t1==t2) mOperands.push_back (t1); else if (t1=='f' || t2=='f') mOperands.push_back ('f'); else std::logic_error ("failed to ....... ");throw

Buffer overflow This bug was found in FreeBSD V512 A call of the 'strcpy' function will lead to overflow of the buffer 'p->vendor'. aacraid_cam.c 571 #define SID_VENDOR_SIZE 8 char vendor[SID_VENDOR_SIZE]; .... strcpy(p->vendor,"Adaptec "); Note. The string contains 8 characters. However, it should be borne in mind, that the strcpy function will add a terminal null. It will be written outside the buffer.

Security issues This bug was found in PostgreSQL V597 The compiler could delete the 'memset' function call, which is used to flush 'final' buffer. The RtlSecureZeroMemory() function should be used to erase the private data. pgcrypto crypt-md5.c 157 The compiler removes the memset function call: http://www.viva64.com/en/w/V597/ char *px_crypt_md5(....) { unsigned char final[MD5_SIZE]; .... /* Don't leave anything around in vm they could use. */ memset(final, 0, sizeof final); }

Confusion with the operation precedence This bug was found in Linux Kernel V502 Perhaps the '?:' operator works in a different way than it was expected. The '?:' operator has a lower priority than the '|' operator. core.c 1046 static int nvme_pr_preempt(struct block_device *bdev, u64 old, u64 new, pr_type type, bool abort) { u32 cdw10 = nvme_pr_type(type) << 8 | abort ? 2 : 1; 1 2

Null pointer/reference dereference This bug was found in LibreOffice V595 The 'pSysWin' pointer was utilized before it was verified against nullptr. Check lines: 738, 739. updatecheckui.cxx 738 MenuBar *pMBar = pSysWin->GetMenuBar(); if ( pSysWin && pMBar ) { AddMenuBarIcon( pSysWin, true ); }

Synchronization errors This bug was found in Unity3D V3083 Unsafe invocation of event 'unload', NullReferenceException is possible. Consider assigning event to a local variable before invoking it. AssetBundleDemo AssetBundleManager.cs 47 internal void OnUnload() { m_AssetBundle.Unload(false); if (unload != null) unload(); }

Integer division by zero This bug was found in Inkscape V609 Divide by zero. Denominator range [0..999]. lpe-fillet-chamfer.cpp 607 } else if (type >= 3000 && type < 4000) { unsigned int chamferSubs = type-3000; double chamfer_stepsTime = 1.0/chamferSubs; Range [0..999]

Typos and Copy-Paste • PVS-Studio effectively detects typos and consequences of inattentive Copy-Paste • The analyzer has a large number of diagnostics to look for bugs of this kind • Let’s look at them in more detail and see a couple of examples of errors of this kind • Additionally, I recommend reading an interesting article “The Last Line Effect” - http://www.viva64.com/en/b/0260/

Typos and Copy-Paste (example 1) This bug was found in Clang V501 There are identical sub-expressions 'OpcodeLHS == BO_LE' to the left and to the right of the '||' operator. RedundantExpressionCheck.cpp 174 if ((OpcodeLHS == BO_EQ || OpcodeLHS == BO_LE || OpcodeLHS == BO_LE) && (OpcodeRHS == BO_EQ || OpcodeRHS == BO_GT || OpcodeRHS == BO_GE))

Typos and Copy-Paste (example N2) This bug was found in GCC V501 There are identical sub-expressions '!strcmp(a->v.val_vms_delta.lbl1, b- >v.val_vms_delta.lbl1)' to the left and to the right of the '&&' operator. dwarf2out.c 1428 return (!strcmp (a->v.val_vms_delta.lbl1, b->v.val_vms_delta.lbl1) && !strcmp (a->v.val_vms_delta.lbl1, b->v.val_vms_delta.lbl1));

Typos and Copy-Paste (example 3) This bug was found in MySQL V525 The code containing the collection of similar blocks. Check items '0', '1', '2', '3', '4', '1', '6' in lines 680, 682, 684, 689, 691, 693, 695. sql records.cc 680 static int rr_cmp(uchar *a,uchar *b) { if (a[0] != b[0]) return (int) a[0] - (int) b[0]; if (a[1] != b[1]) return (int) a[1] - (int) b[1]; if (a[2] != b[2]) return (int) a[2] - (int) b[2]; if (a[3] != b[3]) return (int) a[3] - (int) b[3]; if (a[4] != b[4]) return (int) a[4] - (int) b[4]; if (a[5] != b[5]) return (int) a[1] - (int) b[5]; if (a[6] != b[6]) return (int) a[6] - (int) b[6]; return (int) a[7] - (int) b[7]; } 5

Typos and Copy-Paste (example 4) This bug was found in PowerShell V3001 There are identical sub-expressions 'BaseMaximumVersion != null' to the left and to the right of the '&&' operator. System.Management.Automation ImportModuleCommand.cs 1663 internal Version BaseMinimumVersion { get; set; } internal Version BaseMaximumVersion { get; set; } protected override void ProcessRecord() { if (BaseMaximumVersion != null && BaseMaximumVersion != null && BaseMaximumVersion < BaseMinimumVersion)

Typos and Copy-Paste (example 5) This bug was found in Roslyn V3004 The 'then' statement is equivalent to the 'else' statement. GetSemanticInfoTests.cs 2269 if (i % 2 == 0) { thread1.Start(); thread2.Start(); } else { thread1.Start(); thread2.Start(); }

Typos and Copy-Paste (example 6) This bug was found in MonoDevelop V3012 The '?:' operator, regardless of its conditional expression, always returns one and the same value: result.Test.FullName. GuiUnit_NET_4_5 NUnit2XmlOutputWriter.cs 207 xmlWriter.WriteAttributeString("name", suite.TestType == "Assembly" ? result.Test.FullName : result.Test.FullName);

We showed you a small part of those bugs that PVS-Studio can detect • Detailed table with diagnostic abilities: http://www.viva64.com/en/w/ • Also, there is a detailed description of all the diagnostics Main PVS-Studio diagnostic abilities C, C++ diagnostics C# diagnostics 64-bit issues V101-V128, V201-V207,V220, V221, V301-V303 - Check that addresses to stack memory does not leave the function V506, V507, V558, V758 - Arithmetic over/underflow V636, V658 V3040, V3041 Array index out of bounds V557, V582, V643 V3106 Check for double-free V586, V749 - Dead code V606, V607 - Microoptimization V801-V815 - Unreachable code V551, V695, V734 - Uninitialized variables V573, V614, V679, V730, V737 V3070 Unused variables V603, V751, V763 V3061, V3065, V3077 Illegal bitwise/shift operations V610, V629, V673, V684 - Undefined/unspecified behavior V567, V610, V611, V681, V704, V708, V726, V736 - Incorrect handling of the types (HRESULT, BSTR, BOOL, VARIANT_BOOL) V543, V544, V545, V716, V721, V724, V745, V750, V676, V767 - Improper understanding of function/class operation logic V518, V530, V540, V541, V554, V575, V597, V598, V618, V630, V632, V663, V668, V698, V701, V702, V717, V718, V720, V723, V725, V727, V738, V742, V743, V748, V762, V764 V3010, V3057, V3068, V3072, V3073, V3074, V3082, V3084, V3094, V3096, V3097, V3102, V3103, V3104, V3108 Misprints V501, V503, V504, V508, V511, V516, V519, V520, V521, V525, V527, V528, V529, V532, V533, V534, V535, V536, V537, V539, V546, V549, V552, V556, V559, V560, V561, V564, V568, V570, V571, V575, V577, V578, V584, V587, V588, V589, V590, V592, V600, V602, V604, V606, V607, V616, V617, V620, V621, V622, V625, V626, V627, V633, V637, V638, V639, V644, V646, V650, V651, V653, V654, V655, V660, V661, V662, V666, V669, V671, V672, V678, V682, V683, V693, V715, V722, V735, V747, V754, V756, V765, V767 V3001, V3003, V3005, V3007, V3008, V3009, V3011, V3012, V3014, V3015, V3016, V3020, V3028, V3029, V3034, V3035, V3036, V3037, V3038, V3050, V3055, V3056, V3057, V3062, V3063, V3066, V3081, V3086, V3091, V3092, V3107, V3109 Missing Virtual destructor V599, V689 - Coding style not matching the operation logic of the source code V563, V612, V628, V640, V646, V705 V3018, V3033, V3043, V3067, V3069 Copy-Paste V501, V517, V519, V523, V524, V571, V581, V649, V656, V691, V760, V766 V3001, V3003, V3004, V3008, V3012, V3013, V3021, V3030, V3058 Incorrect usage of exceptions V509, V565, V596, V667, V740, V741, V746, V759 V3006, V3052, V3100 Buffer overrun V512, V514, V594, V635, V641, V645, V752, V755 - Security issues V505, V510, V511, V512, V518, V531, V541, V547, V559, V560, V569, V570, V575, V576, V579, V583, V597, V598, V618, V623, V642, V645, V675, V676, V724, V727, V729, V733, V743, V745, V750 V3022, V3023, V3025, V3027, V3053, V3063 Operation priority V502, V562, V593, V634, V648 - Null pointer pointer/null reference dereference V522, V595, V664, V757 V3019, V3042, V3080, V3095, V3105 Unchecked parameter dereference V595, V664 V3095 Synchronization errors V712 V3032, V3054, V3079, V3083, V3089, V3090 WPF usage errors - V3044 - V3049 Check for integer division by zero V609 V3064 Customized user rules V2001-V2013 -

PVS-Studio abilities demonstration • To show the abilities of the analyzer we check open projects. By the beginning of the year 2017 we have checked 280 projects. • A side effect: our team found 10700 errors in these projects • These are 10700 errors, not messages issued by the analyzer

PVS-Studio abilities demonstration • Thanks to our team and PVS-Studio analyzer, there were more than 10 000 bugs fixed • You may find them all here: http://www.viva64.com/en/examples/ • The base of errors is constantly growing, and it can be used when writing articles about the quality of the code and formulating code standards

PVS-Studio abilities demonstration • On average, we found 10700 / 280 = 38 bugs in one open source project • 38 errors per project is not that much • That’s why it is important to emphasize once more that this was side effect • We don’t have a goal to find as many errors as possible. Quite often, we stop when we find enough errors to write an article.

PVS-Studio abilities demonstration • We have achieved tremendous results in eliminating bugs in the world of open-source project without setting such a goal • What made it possible: • powerful diagnostic abilities of PVS-Studio • the ability to quickly analyze unfamiliar projects

The proper usage scenario • Of course, it’s quite interesting and useful to run PVS-Studio and find an error, that you were unsuccessfully looking for 50 hours before that • http://www.viva64.com/en/b/0221/ • It’s great to check various projects and describe the errors found, like we do it so show the abilities of the tool http://www.viva64.com/en/inspections/ • But we should remember that a one-time check is an incorrect way of using the analyzer!

The proper usage scenario • Static code analyzer is most effective when it is used regularly • Two main approaches: • Automatic analysis of the modified code • Overnight checks • The documentation gives a more detailed description of these modes

Brief facts about the internal design of PVS- Studio

Technologies we use • The examples showed that PVS-Studio detects various kinds of errors • Let’s briefly enumerate the technologies that lie in the basis of the analyzer • More details can be found in the article “How PVS-Studio does the bug search: methods and technologies” http://www.viva64.com/en/b/0466/

Technologies we use • The pattern-based analysis on the basis of an abstract syntax tree is used to look for fragments in the source code that are similar to the known code patterns with an error. Example. Sometimes programmers add 1 in a wrong place when using a strlen function: realloc(name, strlen(name+1)) It should have been written instead: realloc(name, strlen(name)+1)

Technologies we use • The type inference based on the semantic model of the program allows the analyzer to have full information about all variables and statements in the code. The simplest example: to learn that the printf function incorrectly, you need to know types of factual arguments.

Technologies we use • The symbolic execution allows evaluating variable values that can lead to errors, perform range checking of values. • The data-flow analysis is used to evaluate limitations that are imposed on the variable values when processing various language constructs. For example, values that a variable can take inside if/else blocks.

Technologies we use • Method annotations provides more information about the used methods than can be obtained by analyzing only their signatures • C/C++. By this moment we have annotated 6570 functions (standard C and C++ libraries, POSIX, MFC, Qt, ZLib and so on) • • C#. By the moment we have annotated 920 functions

Technologies we use • To develop effective diagnostics, our team uses a large set of regression tests • We have written a special toolkit to work with the test base of open source projects

Technologies we use • The test base: • C++ Windows (Visual C++): 120 projects • C++ Linux (GCC): 34 more projects • C# Windows: 54 projects • We use 7 methods of testing our project • See the section “Testing PVS-Studio” http://www.viva64.com/en/b/0466/

• You might be quite tired by this moment already, so here is a joke • In a nutshell, the whole point of static analysis is in the following: Again Copy-Paste!

Using PVS-Studio: introducing into existing project • It may be not easy to start using static analysis on a large project • It’s unclear, what to do with the messages for the old code... • Here is our solution: the markup base • More details: http://www.viva64.com/en/b/0364/

Using PVS-Studio: suppression of false positives • Various ways to suppress false positives in certain code lines • Suppression of false positives in macros • Suppression of false positives with the help of diagnostics configuration files .pvsconfig • More details: http://www.viva64.com/en/m/0017/

Using PVS-Studio: exclusion from analysis • An ability to exclude files from the analysis using a name, file or a mask • Interactive filtering of the analysis results (the log file) in the PVS- Studio window: • by the diagnostic code • by the file name • by the keyword in the text of the diagnostic

Using PVS-Studio: automatic analysis of individual files after their recompilation • Find a bug right after it appeared in the code.

Using PVS-Studio: scalability • Support of multi-core and multi-processor systems with the possibility to specify the number of the cores to use • IncrediBuild Support

Using PVS-Studio: continuous integration • Project analysis run from the command line: helps integrate PVS- Studio into overnight builds; a new log will be issued in the morning • Saving and loading analysis results allow doing overnight checks - during the night, saving the results into a log file and analyzing these results in the morning • BlameNotifier utility: the tool allows you to send e-mails to the developers about bugs that PVS-Studio found during an overnight run. • Usage of relative paths in the report files

Using PVS-Studio: miscellaneous • Convenient online reference concerning all the diagnostics available in the program, on the web-site and as offline documentation (presented as a .pdf file) • Interactive filtering of the analysis results (the log file) in the PVS- Studio window • Error statistics in Excel • Automatic check for new versions of PVS-Studio

Using PVS-Studio: Linux • It’s very easy to work with PVS-Studio in Linux • But we suggest to read the instructions first: • How to run PVS-Studio on Linux: http://www.viva64.com/en/m/0036/ • I know that all people don't like to read instructions. Believe me, this is just the case when everything is simple, brief and saves your time!

Using PVS-Studio: quick start • Special attention should be drawn to the fact that it’s easy to try PVS- Studio on any project • To do that, you should track the compiler runs and gather all the necessary information for the analysis • Windows: • Standalone utility • Instructions: http://www.viva64.com/en/m/0033/ • Linux • pvs-studio analyzer utility • Instruction: see “quick start” in the document http://www.viva64.com/en/m/0036/

Using PVS-Studio: SonarQube • PVS-Studio provides a sonar-pvs-studio- plugin to import the analysis results. • Using the plugin allows you to add messages found by PVS-Studio Analyzer to the message base of SonarQube server

Using PVS-Studio: SonarQube • Details are given in the article “Control source code quality using the SonarQube platform” http://www.viva64.com/en/b/0452/

Download and try PVS-Studio • You can download and try the demo version • Windows: http://www.viva64.com/en/pvs-studio-download/ • Linux: http://www.viva64.com/en/pvs-studio-download-linux/ • Explanation about the PVS-Studio demo-version limitations: http://www.viva64.com/en/m/0009/ • You can contact us and get a fully functional trial version: support@viva64.com

Types of licenses Team License Enterprise License Best suits a small department, usually it’s the first experience of using analyzers Suitable for multiple departments within the company Windows-version only Versions for Windows and Linux Support of continuous integration systems Integration with SonarQube BlameNotifier Tool An ability to suggest custom tools The license can be purchased only for 1 year The license can be purchased for 1, 2 or 3 years E-mail reply within 48 hours E-mail reply within 24 hours Typically is used in teams up to 9 people Mainly is used in teams of more than 10 people

Individual license • We see our product as a B2B solution and therefore, there are no individual licenses • Here is the story of why it is so: http://www.viva64.com/en/b/0320/ • Individual developers can use a free license • How to use PVS-Studio for free: http://www.viva64.com/en/b/0457/

Purchase PVS-Studio • To order the license and get pricing information, please contact us: support@viva64.com

Besides the option to purchase the license for the static code analyzer, there are other options of cooperation

Cooperation: code audit • Doing the code audit and fixing bugs • Examples of such cooperation earlier: • How the PVS-Studio Team Improved Unreal Engine's Code: http://www.viva64.com/en/b/0330/ • How to Port a 9 Million Code Line Project to 64 bits: http://www.viva64.com/en/b/0342/ • We can control the quality of the code and make necessary changes on a regular basis • We have experience in that, but this information falls under NDA

Cooperation • On the basis of our analyzer we can develop a custom solution • We are also ready to discuss details of cooperation with software resellers • On these and other issues: support@viva64.com

The presentation is coming to an end Thanks to everyone!

Useful links • Couple of words about interesting and useful material that can be found on the company’s site • An e-book: “The Ultimate Question of Programming, Refactoring, and Everything” - http://www.viva64.com/en/b/0391/ • An e-book: “Lessons on development of 64-bit C/C++ applications” - http://www.viva64.com/en/l/full/

Useful links • PVS-Studio project - 10 years of failures and successes: http://www.viva64.com/en/b/0465/ • Control source code quality using the SonarQube platform: http://www.viva64.com/en/b/0452/ • Manual on development of Visual Studio 2005-2012 and Atmel Studio plugins in C#: http://www.viva64.com/en/a/0082/

Thank you all! See you! • Write to us: support@viva64.com • Follow us on Twitter: @Code_Analysis • Download PVS-Studio for Windows: http://www.viva64.com/en/pvs-studio/ • Download PVS-Studio for Linux: http://www.viva64.com/en/pvs-studio-download-linux/

PVS-Studio. Static code analyzer. Windows/Linux, C/C++/C#. 2017

More Related Content

What's hot

Viewers also liked

Similar to PVS-Studio. Static code analyzer. Windows/Linux, C/C++/C#. 2017

More from Andrey Karpov

Recently uploaded

PVS-Studio. Static code analyzer. Windows/Linux, C/C++/C#. 2017