PVS-Studio

https://pvs-studio.ru/ru/docs
Admin
PVS-Studio is a static code analyzer for C, C++, C#, and Java that identifies bugs, vulnerabilities,...
Tokens:1,582,925
Snippets:11,461
Trust Score:8.4
Update:1 week ago
Show doc for...
Tokens:
Raw
### Show installer help

Source: https://pvs-studio.ru/ru/docs/manual/0025

Displays additional information about the installer flags.

```text
PVS-Studio_setup.exe /help
```

--------------------------------

### PVS-Studio.cfg configuration example

Source: https://pvs-studio.ru/ru/docs/manual/0006

Example PVS-Studio.cfg configuration file for standalone analysis. It sets the exclude path, Visual C++ installation directory, platform, preprocessor, language, and the skip-cl-exe option. This file is shared by all C/C++ files and is passed via the --cfg parameter.

```ini
exclude-path = C:\Program Files (x86)\Microsoft Visual Studio 10.0
vcinstalldir = C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\
platform = Win32
preprocessor = visualcpp
language = C++
skip-cl-exe = no
```

--------------------------------

### Install pvs-golang via Homebrew

Source: https://pvs-studio.ru/ru/docs/manual/7187

Install pvs-golang via Homebrew.

```bash
brew install viva64/pvs-studio/pvs-golang
```

--------------------------------

### Install PVS-Studio via Homebrew

Source: https://pvs-studio.ru/ru/docs/manual/0051

Install PVS-Studio and PVS-Studio .NET analyzer on macOS using Homebrew. Run both commands to install the analyzer and its .NET component.

```bash
brew install viva64/pvs-studio/pvs-studio
brew install viva64/pvs-studio/pvs-studio-dotnet
```

--------------------------------

### Secure path traversal example

Source: https://pvs-studio.ru/ru/docs/warnings/v5332

Fixed example: normalizes the resolved path and checks it starts with the intended directory before reading the file.

```java
HttpServletRequest request;
HttpServletResponse response;

void write(Path userdir) throws IOException {

    ....

    String userFileRelativePath = request.getParameter("relativePath");

    Path fullPath = userdir.resolve(userFileRelativePath);
    
    if (fullPath.normalize().startsWith(userdir)) {
        String content = Files.readString(fullPath);

        ....

        response.getWriter().write(content);
    } else {
        ....
    }
}
```

--------------------------------

### Example: --license-file flag

Source: https://pvs-studio.ru/ru/docs/manual/7195

Sets a custom path to the license file. On Windows it should be Settings.xml, on Linux/macOS PVS-Studio.lic.

```bash
pvs-js analyze /path/to/project \
               --license-file /path/to/project/PVS-Studio.lic
```

--------------------------------

### Travis CI: add PVS-Studio repository and install dependencies

Source: https://pvs-studio.ru/ru/docs/manual/0057

Adds the PVS-Studio repository, installs its public key, and installs the required dependencies and additional packages (including pvs-studio and sendemail) before the build starts.

```yaml
before_install:
 - sudo add-apt-repository ppa:ubuntu-lxc/daily -y
 - wget -q -O - https://files.pvs-studio.com/etc/pubkey.txt |sudo apt-key add -
 - sudo wget -O /etc/apt/sources.list.d/viva64.list
              https://files.pvs-studio.com/etc/viva64.list
 - sudo apt-get update -qq
 - sudo apt-get install -qq coccinelle parallel 
       libapparmor-dev libcap-dev libseccomp-dev
       python3-dev python3-setuptools docbook2x
       libgnutls-dev libselinux1-dev linux-libc-dev pvs-studio
       libio-socket-ssl-perl libnet-ssleay-perl sendemail 
       ca-certificates
```

--------------------------------

### Install pvs-golang from archive on Linux

Source: https://pvs-studio.ru/ru/docs/manual/7187

Extract the archive and run the install script.

```bash
tar -xzf pvs-golang-VERSION.tar.gz
sudo ./install.sh
```

--------------------------------

### Example triggering V576 with SEC-STR-FORMAT

Source: https://pvs-studio.ru/ru/docs/manual/6630

Example code that triggers warning V576 about passing a wide string to printf. With //V_SEC_ID: SHOW enabled, the warning gets the SEC-STR-FORMAT identifier in the SAST field.

```cpp
void func()
{
  const wchar_t wstr[] = L"12345";
  printf("%s\n", wstr);
}
```

--------------------------------

### V791: Suboptimal bubble sort with inner loop starting at 'i' (C)

Source: https://pvs-studio.ru/ru/docs/warnings/v791

Real-world example from a device priority sorting algorithm that triggers V791: the inner loop starts at 'i', making the bubble sort suboptimal.

```C
/* Simple bubble sort */
for (i = 0; i < n_devices; ++i) {
  for (uint32_t j = i; j < n_devices; ++j) {
    if (devices[i]->prio > devices[j]->prio) {
      struct device_t *tmp;
      tmp = devices[i];
      devices[i] = devices[j];
      devices[j] = tmp;
    }
  }
}
```

--------------------------------

### Example Java analyzer configuration file

Source: https://pvs-studio.ru/ru/docs/manual/6703

Example configuration file that sets source files, thread count, output file, output type, user name, and license key. Command-line parameters take precedence over values in this file.

```json
{
  "src": ["A.java", "B.java", "C.java"],
  "threads": 4,
  "output-file": "report.txt",
  "output-type": "text",
  "user-name": "someName",
  "license-key": "someSerial"
  ....
}
```

--------------------------------

### V3140: Property accessors use different backing fields (incorrect example)

Source: https://pvs-studio.ru/ru/docs/warnings/v3140

Example of a property accessor error where the get accessor of the 'Copyright' property returns the wrong backing field '_heading' instead of '_copyright'.

```csharp
String _heading; String _copyright;

public string Heading
{   
    get { return this._heading; }
    set { this._heading = value; } 
}

public string Copyright
{   
    get { return this._heading; }
    set { this._copyright = value; }
}
```

--------------------------------

### Установка Deb пакета с помощью dpkg и apt-get -f install

Source: https://pvs-studio.ru/ru/docs/manual/0039

Установка PVS-Studio из Deb пакета с помощью dpkg, с последующим исправлением зависимостей через apt-get -f install.

```bash
sudo dpkg -i pvs-studio-VERSION.deb
sudo apt-get -f install
```

--------------------------------

### V791: Corrected bubble sort with inner loop starting at 'i + 1' (C)

Source: https://pvs-studio.ru/ru/docs/warnings/v791

Corrected version of the bubble sort example: the outer loop goes to 'n_devices - 1' and the inner loop starts at 'i + 1', avoiding unnecessary comparisons.

```C
/* Simple bubble sort */
for (i = 0; i < n_devices - 1; ++i) {
  for (uint32_t j = i + 1; j < n_devices; ++j) {
    if (devices[i]->prio > devices[j]->prio) {
      struct device_t *tmp;
      tmp = devices[i];
      devices[i] = devices[j];
      devices[j] = tmp;
    }
  }
}
```

--------------------------------

### Get analyzer help with --help

Source: https://pvs-studio.ru/ru/docs/manual/6703

Run this command to display all available analyzer arguments.

```bash
java -jar pvs-studio.jar --help
```

--------------------------------

### Install pvs-golang on zypper-based systems

Source: https://pvs-studio.ru/ru/docs/manual/7187

For zypper-based systems, add the repository and install pvs-golang.

```bash
wget -q -O /tmp/viva64.key \
  https://cdn.pvs-studio.ru/etc/pubkey.txt

sudo rpm --import /tmp/viva64.key
sudo zypper ar -f https://cdn.pvs-studio.ru/rpm viva64

sudo sed -i \
  's|enabled=1|enabled=1\ngpgkey=https://cdn.pvs-studio.ru/etc/pubkey.txt|' \
  /etc/zypp/repos.d/viva64.repo

sudo zypper refresh
sudo zypper install pvs-golang
```

--------------------------------

### Correct octal/hex escape sequence termination

Source: https://pvs-studio.ru/ru/docs/warnings/v2602

Correct examples: the escape sequence is terminated by ending the string literal or by starting a new escape sequence.

```cpp
const char *str1 = "\x0" "exit";
const char *str2 = "\x1f\x2f";
```

--------------------------------

### Install PVS-Studio and set credentials

Source: https://pvs-studio.ru/ru/docs/manual/7176

Install PVS-Studio and configure credentials using the $PVS_NAME and $PVS_KEY variables, which must be set in the repository's CI/CD settings.

```yaml
- wget -O - https://files.pvs-studio.com/etc/pubkey.txt 
| apt-key add -
- wget -O /etc/apt/sources.list.d/viva64.list 
https://files.pvs-studio.com/etc/viva64.list
- apt-get update && apt-get -y install pvs-studio
- pvs-studio-analyzer credentials $PVS_NAME $PVS_KEY
```

--------------------------------

### Install pvs-golang from archive on macOS

Source: https://pvs-studio.ru/ru/docs/manual/7187

Extract the archive and run the install script on macOS.

```bash
unzip pvs-golang-VERSION.zip
sudo ./install.sh
```

--------------------------------

### Corrected switch with distinct case bodies

Source: https://pvs-studio.ru/ru/docs/warnings/v8009

Fixes the previous example by making the 'stop' case call Stop() instead of Start(), so each case performs its intended action.

```go
switch msg {
case "start":
  Start()
case "stop":
  Stop()
}
```

--------------------------------

### Clearer switch using combined case labels

Source: https://pvs-studio.ru/ru/docs/warnings/v8009

Improves the previous example by combining the 'start' and 'begin' labels into a single case, making the intent clear and avoiding ambiguity.

```go
switch msg {
case "start", "begin":
  Start()
default:
  Stop()
}
```

--------------------------------

### Corrected archive extraction example

Source: https://pvs-studio.ru/ru/docs/warnings/v5338

This version prevents Zip Slip by using getCanonicalPath() to verify that the target file path starts with the destination directory before performing file operations.

```java
public void extractArchive(String destinationDir, ZipFile zip) {
    Enumeration<? extends ZipEntry> entries = zip.entries();
    while (entries.hasMoreElements()) {
        ZipEntry entry = entries.nextElement();

        File file = new File(destinationDir, entry.getName());

        if (file.getCanonicalPath().startsWith(destinationDir)) {
            InputStream input = zip.getInputStream(entry);
            IOUtils.copy(input, new WriterOutputStream(new FileWriter(file)));
        }
    }
}
```

--------------------------------

### Quick start: run Java analyzer with options

Source: https://pvs-studio.ru/ru/docs/manual/6703

Runs the PVS-Studio Java analyzer core on source files with classpath entries, concurrency, output file, and text format. Requires a license to be entered before analysis.

```bash
java -jar pvs-studio.jar -s A.java B.java C.java -e Lib1.jar Lib2.jar -j4 
-o report.txt -O text --user-name someName –-license-key someSerial
```

--------------------------------

### Установка для debian-based систем

Source: https://pvs-studio.ru/ru/docs/manual/0051

Команды для установки из репозитория в Debian/Ubuntu. Добавляют ключ и репозиторий, обновляют список пакетов и устанавливают pvs-studio-dotnet.

```bash
wget -q -O - https://cdn.pvs-studio.com/etc/pubkey.txt | \
  sudo apt-key add -
sudo wget -O /etc/apt/sources.list.d/viva64.list \
  https://cdn.pvs-studio.com/etc/viva64.list
sudo apt-get update
sudo apt-get install pvs-studio-dotnet
```

--------------------------------

### V3140: Corrected property accessors using matching backing fields

Source: https://pvs-studio.ru/ru/docs/warnings/v3140

Corrected version of the previous example where the 'Copyright' property's get accessor returns the '_copyright' field.

```csharp
String _heading; String _copyright;

public string Heading
{   
    get { return this._heading; }
    set { this._heading = value; }
}

public string Copyright
{   
    get { return this._copyright; }
    set { this._copyright = value; }
}
```

--------------------------------

### Incorrect enum with implicitly duplicated values

Source: https://pvs-studio.ru/ru/docs/warnings/v2503

Incorrect code example: the implicitly initialized enumerator SUITS_HEARTS gets the value 4, which duplicates the explicitly specified value of SUITS_UNKNOWN.

```cpp
enum Suits 
{ 
  SUITS_SPADES = 1,
  SUITS_CLUBS,
  SUITS_DIAMONDS,  
  SUITS_HEARTS,
  SUITS_UNKNOWN = 4 
};
```

--------------------------------

### MyProject.cfg configuration file

Source: https://pvs-studio.ru/ru/docs/manual/6615

Example configuration file for PVS-Studio analyzer. Sets license file, exclude paths, platform, preprocessor, and analysis mode.

```plaintext
lic-file=~/.config/PVS-Studio/PVS-Studio.lic
exclude-path=*/tests/*
exclude-path=*/lib/*
exclude-path=*/third-party/*
platform=linux64
preprocessor=clang
analysis-mode=4

```

--------------------------------

### Class implementing an interface with 'close' method

Source: https://pvs-studio.ru/ru/docs/warnings/v6116

This example shows a class that implements an interface with a 'close' method, but the interface does not extend Closeable or AutoCloseable. This is the starting point for the three solutions described in the documentation.

```java
interface SomeInterface {
  public void close(); 
}

class SomeInterfaceImpl implements SomeInterface {
  private FileWriter resource;
  
  public SomeInterfaceImpl(String name) {
    resource = new FileWriter(name); 
  }
  
  public void close() {
    resource.close(); 
  }
}
```

--------------------------------

### Установка из репозитория для debian-based систем (до Debian 11 и Ubuntu 22.04)

Source: https://pvs-studio.ru/ru/docs/manual/0039

Команды для добавления репозитория PVS-Studio и установки пакета pvs-studio в системах до Debian 11 и Ubuntu 22.04. Использует apt-key для добавления ключа.

```bash
wget -q -O - https://cdn.pvs-studio.ru/etc/pubkey.txt | \
  sudo apt-key add -

sudo wget -O /etc/apt/sources.list.d/viva64.list \
  https://cdn.pvs-studio.ru/etc/viva64.list

sudo apt-get update
sudo apt-get install pvs-studio
```

--------------------------------

### Inefficient strlen on std::string (V806)

Source: https://pvs-studio.ru/ru/docs/warnings/v806

Example of inefficient code that uses strlen(rStr.c_str()) to get the length of a std::string. The analyzer warns that this can be replaced with the string's length() method.

```cpp
static UINT GetSize(const std::string& rStr)
{
  return (strlen(rStr.c_str()) + 1 );
}
```

--------------------------------

### Corrected practical example: if ((hr = AVIFileGetStream(...)) != AVIERR_OK)

Source: https://pvs-studio.ru/ru/docs/warnings/v593

This example shows the corrected version of the previous practical example, using parentheses to ensure the assignment is performed before the comparison.

```cpp
if ((hr = AVIFileGetStream(pfileSilence,
           &paviSilence, typeAUDIO, 0)) != AVIERR_OK)
{
  ErrMsg("Unable to load silence stream");
  return hr; 
}
```

--------------------------------

### Correct approach: call AwaitableFoo again to get a fresh Awaitable

Source: https://pvs-studio.ru/ru/docs/warnings/v3209

This example shows another safe alternative: call AwaitableFoo() again where needed, so each call returns a new Awaitable object. This avoids reusing the same Awaitable.

```csharp
async Awaitable<bool> AwaitableFoo() { .... }

async Awaitable ExampleFoo()
{
  if (await AwaitableFoo())
  {
    var result = await AwaitableFoo();
    ....
  }
}
```

--------------------------------

### Full UnrealBuildTool command line with PVS-Studio flag

Source: https://pvs-studio.ru/ru/docs/manual/0043

Example of a complete UnrealBuildTool command line that includes the -StaticAnalyzer=PVSStudio flag. This is a typical invocation for analyzing a UE4 client project.

```text
UnrealBuildTool.exe UE4Client Win32 Debug -WaitMutex -FromMsBuild 
    -StaticAnalyzer=PVSStudio -DEPLOY
```
Tokens:
Raw