### Install PVS-Studio Analyzer in Buddy Source: https://pvs-studio.ru/ru/docs/manual/6668 Commands to update package lists, install necessary tools, add the PVS-Studio repository key and source list, and finally install the pvs-studio package. Ensure your system has wget, gnupg, and jq installed. ```bash apt-get update && apt-get -y install wget gnupg jq wget -q -O - https://files.pvs-studio.com/etc/pubkey.txt | apt-key add - wget -O /etc/apt/sources.list.d/viva64.list \ https://files.pvs-studio.com/etc/viva64.list apt-get update && apt-get -y install pvs-studio ``` -------------------------------- ### Install PVS-Studio from archive Source: https://pvs-studio.ru/ru/docs/manual/0039 Installs PVS-Studio by extracting an archive and running the installation script. Requires the _strace_ utility version 4.11 or higher. ```bash tar -xzf pvs-studio-VERSION.tgz sudo ./install.sh ``` -------------------------------- ### Manual installation of pvs-golang from zip Source: https://pvs-studio.ru/ru/docs/manual/7187 Installs pvs-golang manually from a zip archive on macOS. This involves unzipping the archive and executing an install script. ```bash unzip pvs-golang-VERSION.zip sudo ./install.sh ``` -------------------------------- ### Manual installation of pvs-golang from tar.gz Source: https://pvs-studio.ru/ru/docs/manual/7187 Installs pvs-golang manually by extracting an archive and running an install script. This method is applicable when package managers are not used or preferred. ```bash tar -xzf pvs-golang-VERSION.tar.gz sudo ./install.sh ``` -------------------------------- ### Install pvs-golang on zypper-based systems Source: https://pvs-studio.ru/ru/docs/manual/7187 Installs pvs-golang on zypper-based Linux distributions. This involves importing the public key, adding the repository, and refreshing the package list before installation. ```bash wget -q -O /tmp/viva64.key \ https://cdn.pvs-studio.ru/etc/pubkey.txt sudo rpm --import /tmp/viva64.key sudo zypper ar -f https://cdn.pvs-studio.ru/beta/rpm viva64 sudo sed -i \ 's|enabled=1|enabled=1\ngpgkey=https://cdn.pvs-studio.ru/etc/pubkey.txt|' \ /etc/zypp/repos.d/viva64.repo sudo zypper refresh sudo zypper install pvs-golang ``` -------------------------------- ### Install pvs-js on zypper-based systems Source: https://pvs-studio.ru/ru/docs/manual/7188 Install pvs-js on zypper-based systems. This involves downloading the public key, importing it, adding the repository, configuring the repository to use the GPG key, refreshing repositories, and finally installing the package. ```bash wget -q -O /tmp/viva64.key \ https://cdn.pvs-studio.ru/etc/pubkey.txt sudo rpm --import /tmp/viva64.key sudo zypper ar -f https://cdn.pvs-studio.ru/beta/rpm viva64 sudo sed -i \ 's|enabled=1|enabled=1\ngpgkey=https://cdn.pvs-studio.ru/etc/pubkey.txt|' \ /etc/zypp/repos.d/viva64.repo sudo zypper refresh sudo zypper install pvs-js ``` -------------------------------- ### V3082 Thread Lifecycle Examples Source: https://pvs-studio.ru/ru/docs/warnings/v3082 Demonstrates the incorrect pattern of creating a thread without starting it, and the corrected version using the Start() method. ```csharp void Foo(ThreadStart action) { Thread thread = new Thread(action); thread.Name = "My Thread"; } ``` ```csharp void Foo(ThreadStart action) { Thread thread = new Thread(action); thread.Name = "My Thread"; thread.Start(); } ``` -------------------------------- ### Example Gradle Command with Parameters Source: https://pvs-studio.ru/ru/docs/manual/6706 This example demonstrates how to execute the Gradle PVS-Studio analysis task with specific output type, output file, and disabled warnings. ```bash ./gradlew pvsAnalyze -Ppvsstudio.outputType=text -Ppvsstudio.outputFile=path/to/output.txt -Ppvsstudio.disabledWarnings=V6001;V6002;V6003 ``` -------------------------------- ### Install PVS-Studio Analyzer Source: https://pvs-studio.ru/ru/docs/manual/7176 Sets up the PVS-Studio static analysis tool by adding its repository and installing the package. Ensure to replace placeholders with your actual PVS-Studio username and license key. ```bash - wget -O - https://files.pvs-studio.com/etc/pubkey.txt | apt-key add - - wget -O /etc/apt/sources.list.d/viva64.list https://files.pvs-studio.com/etc/viva64.list - apt-get update && apt-get -y install pvs-studio - pvs-studio-analyzer credentials $PVS_NAME $PVS_KEY ``` -------------------------------- ### Incorrect Array.FindLastIndex usage Source: https://pvs-studio.ru/ru/docs/warnings/v3186 Example of an invalid call to Array.FindLastIndex where the search range extends before the start of the array. ```csharp int[] arr = new int[] { 0, 1, 3, 4 }; var lastEvenInd = Array.FindLastIndex(arr, startIndex: 1, count: 3, x => x % 2 == 0); ``` -------------------------------- ### Example Build Command for PVS-Studio Source: https://pvs-studio.ru/ru/docs/manual/0043 A sample command line for triggering an Unreal Engine build with PVS-Studio analysis enabled. ```text "Path_to_UE\Engine\Build\BatchFiles\Build.bat" ProjectGame Win64 DebugGame ^ -Project="Path_to_projet\ProjcetGame.uproject" ^ -WaitMutex -FromMsBuild -StaticAnalyzer=PVSStudio ``` -------------------------------- ### Incorrect file path with escape sequences Source: https://pvs-studio.ru/ru/docs/warnings/v1094 An example of an invalid file path where backslashes are interpreted as the start of escape sequences. ```cpp FILE* file = fopen("C:\C\Names.txt", "r"); ``` -------------------------------- ### Database Connection Configuration Examples Source: https://pvs-studio.ru/ru/docs/warnings/v5326 Demonstrates an insecure configuration with a hardcoded empty password and a secure alternative using system properties. ```java var dataSource = new PGSimpleDataSource(); dataSource.setDatabaseName("db"); dataSource.setUser("server"); dataSource.setPassword(""); // .... ``` ```java var dataSource = new PGSimpleDataSource(); dataSource.setDatabaseName("db"); dataSource.setUser(System.getProperty("db.user")); dataSource.setPassword(System.getProperty("db.password")); // .... ``` -------------------------------- ### ThreadStatic field initialization issue Source: https://pvs-studio.ru/ru/docs/warnings/v3089 This example demonstrates the problem where a ThreadStatic field initialized at declaration gets the default value on subsequent threads. ```csharp class SomeClass { [ThreadStatic] public static Int32 field = 42; } class EntryPoint { static void Main(string[] args) { new Task(() => { var a = SomeClass.field; }).Start(); // a == 42 new Task(() => { var a = SomeClass.field; }).Start(); // a == 0 new Task(() => { var a = SomeClass.field; }).Start(); // a == 0 } } ``` -------------------------------- ### Complex example of incorrect pointer reference in C++ Source: https://pvs-studio.ru/ru/docs/warnings/v207 This example illustrates a more complex scenario where a pointer is incorrectly cast to an enum type, causing memory corruption in 64-bit systems. The 'Get' function modifies memory beyond the bounds of the 'enum' variable 'e'. ```C++ enum MyEnum { VAL1, VAL2 }; void Get(void*& data) { static int value; data = &value; } void M() { MyEnum e; Get((void*&)e); .... } ``` -------------------------------- ### Install PVS-Studio on zypper-based systems Source: https://pvs-studio.ru/ru/docs/manual/0039 Installs PVS-Studio on zypper-based systems, importing the GPG key and adding the PVS-Studio repository. ```bash wget -q -O /tmp/viva64.key \ https://cdn.pvs-studio.ru/etc/pubkey.txt sudo rpm --import /tmp/viva64.key sudo zypper ar -f https://cdn.pvs-studio.ru/rpm viva64 sudo sed -i \ 's|enabled=1|enabled=1\ngpgkey=https://cdn.pvs-studio.ru/etc/pubkey.txt|' \ /etc/zypp/repos.d/viva64.repo sudo zypper refresh sudo zypper install pvs-studio ``` -------------------------------- ### Build Docker Image for Zypper-based Systems Source: https://pvs-studio.ru/ru/docs/manual/0047 Dockerfile for building a PVS-Studio image on openSUSE (zypper-based) systems. Includes dependency installation and PVS-Studio setup. ```dockerfile FROM opensuse:42.3 # INSTALL DEPENDENCIES RUN zypper update -y \ && zypper install -y --no-recommends wget \ && zypper clean --all # INSTALL PVS-Studio RUN wget -q -O /tmp/viva64.key https://files.pvs-studio.com/etc/pubkey.txt \ && rpm --import /tmp/viva64.key \ && zypper ar -f https://files.pvs-studio.com/rpm viva64 \ && zypper update -y \ && zypper install -y --no-recommends pvs-studio strace \ && pvs-studio --version \ && zypper clean -all ``` -------------------------------- ### Prepare Docker Image (Install PVS-Studio Core) Source: https://pvs-studio.ru/ru/docs/manual/0047 This Dockerfile snippet demonstrates how to install the PVS-Studio Java analyzer core from a zip archive within a Ubuntu-based Docker image. It downloads the specified version, extracts it, and cleans up the archive. ```dockerfile FROM openkbs/ubuntu-bionic-jdk-mvn-py3 ARG PVS_CORE="7.42.105102" RUN wget "https://files.pvs-studio.com/java/pvsstudio-cores/${PVS_CORE}.zip" -O ${PVS_CORE}.zip \ && mkdir -p ~/.config/PVS-Studio-Java \ && unzip ${PVS_CORE}.zip -d ~/.config/PVS-Studio-Java \ && rm -rf ${PVS_CORE}.zip ``` -------------------------------- ### MISRA C/C++: Reserved Identifiers Example Source: https://pvs-studio.ru/ru/docs/warnings/v2573 This code demonstrates how a macro definition starting with '_' can conflict with built-in functions, potentially altering program behavior. Ensure that custom identifiers do not clash with reserved naming conventions. ```c #define _BUILTIN_abs(x) (x < 0 ? -x : x) #include int foo(int x, int y, bool c) { return abs(c ? x : y) } ``` ```c #define abs(x) (_BUILTIN_abs(x)) ``` -------------------------------- ### Configure PVS-Studio Credentials Source: https://pvs-studio.ru/ru/docs/manual/0057 Set up the PVS-Studio analyzer credentials using the provided username and key, saving the license to a file. ```bash - pvs-studio-analyzer credentials $PVS_USERNAME $PVS_KEY -o PVS-Studio.lic ``` -------------------------------- ### Complete GitFlic CI/CD Configuration Source: https://pvs-studio.ru/ru/docs/manual/7176 This is the full content of the 'gitflic-ci.yaml' file, integrating all the previously mentioned steps for PVS-Studio analysis within a GitFlic pipeline. It includes dependency installation, PVS-Studio setup, project build, analysis, report conversion, and artifact configuration. ```yaml analyze-job: stage: build scripts: - apt install cmake - apt-get install gcc - apt-get install doxygen - wget -O - https://files.pvs-studio.com/etc/pubkey.txt | apt-key add - - wget -O /etc/apt/sources.list.d/viva64.list https://files.pvs-studio.com/etc/viva64.list - apt-get update && apt-get -y install pvs-studio - pvs-studio-analyzer credentials ${USER_NAME} ${LICENSE_KEY} - cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=On . - pvs-studio-analyzer analyze -o report.log - plog-converter report.log -t json -n relative -R toRelative -r $PWD - plog-converter relative.json -t sarif -n PVSSarif -r file:// artifacts: reports: sast: paths: - 'PVSSarif.sarif' ``` -------------------------------- ### Manual installation of pvs-js from archive Source: https://pvs-studio.ru/ru/docs/manual/7188 Install pvs-js manually by downloading the archive, extracting it, and running the install script. Ensure you have the necessary dependencies installed separately. ```bash tar -xzf pvs-js-VERSION.tar.gz sudo ./install.sh ``` -------------------------------- ### PVS-Studio Configuration File Example Source: https://pvs-studio.ru/ru/docs/manual/0006 A sample PVS-Studio configuration file. It specifies paths, preprocessor details, language, and enables independent analysis mode using a preprocessed i-file. ```ini exclude-path = C:\Program Files (x86)\Microsoft Visual Studio 10.0 vcinstalldir = C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\ platform = Win32 preprocessor = visualcpp language = C++ skip-cl-exe = yes i-file = C:\Test\test.i ``` -------------------------------- ### Manual installation of pvs-js from zip archive on macOS Source: https://pvs-studio.ru/ru/docs/manual/7188 Install pvs-js manually on macOS by downloading the zip archive, extracting it, and running the install script. This method is an alternative to using the .pkg installer. ```bash unzip pvs-js-VERSION.zip sudo ./install.sh ``` -------------------------------- ### Launching Qt Creator with Custom Plugin Path (Linux) Source: https://pvs-studio.ru/ru/docs/manual/6648 Use this command to launch Qt Creator and specify an alternative directory for loading plugins on Linux. Replace '$путь_до_директории_с_плагином' with the actual path to your plugin directory. ```bash qtcreator -pluginpath "$путь_до_директории_с_плагином" ``` -------------------------------- ### Install pvs-golang on yum-based systems Source: https://pvs-studio.ru/ru/docs/manual/7187 Installs pvs-golang on yum-based Linux distributions. Requires downloading the repository file and then installing the package. ```bash wget -O /etc/yum.repos.d/viva64.repo \ https://cdn.pvs-studio.ru/beta/etc/viva64.repo yum update yum install pvs-golang ``` -------------------------------- ### PVS-Studio Configuration File Example Source: https://pvs-studio.ru/ru/docs/manual/6615 Define project-specific analysis parameters in a configuration file. This file can specify license location, paths to exclude, the target platform, preprocessor, and analysis mode. ```ini lic-file=~/.config/PVS-Studio/PVS-Studio.lic exclude-path=*/tests/* exclude-path=*/lib/* exclude-path=*/third-party/* platform=linux64 preprocessor=clang analysis-mode=4 ``` -------------------------------- ### Install pvs-js on yum-based systems Source: https://pvs-studio.ru/ru/docs/manual/7188 Install pvs-js on yum-based systems by downloading the repository configuration file and then updating and installing the package. ```bash wget -O /etc/yum.repos.d/viva64.repo \ https://cdn.pvs-studio.ru/beta/etc/viva64.repo yum update yum install pvs-js ``` -------------------------------- ### Install blame-notifier using Homebrew on macOS Source: https://pvs-studio.ru/ru/docs/manual/0050 Installs the blame-notifier utility on macOS using Homebrew. Ensure Homebrew is installed and updated. ```bash brew install viva64/pvs-studio/blame-notifier ``` -------------------------------- ### Launching Qt Creator with Custom Plugin Path (Windows) Source: https://pvs-studio.ru/ru/docs/manual/6648 Use this command to launch Qt Creator and specify an alternative directory for loading plugins on Windows. Replace '%путь_до_директории_с_плагином%' with the actual path to your plugin directory. ```batch qtcreator.exe -pluginpath "%путь_до_директории_с_плагином%" ``` -------------------------------- ### Run PVS-Studio_Cmd with Custom Settings Source: https://pvs-studio.ru/ru/docs/manual/6653 Example of invoking PVS-Studio_Cmd.exe with a custom settings file. Ensure the path to your solution and the settings file are correctly specified. ```bash PVS-Studio_Cmd.exe -t "path\to\Solution.sln" ... \ --settings "path\to\CustomSettings.xml" ``` -------------------------------- ### Prepare Docker Image (Windows) Source: https://pvs-studio.ru/ru/docs/manual/0047 This Dockerfile snippet sets up a Windows-based Docker image using the .NET Framework runtime. It installs Chocolatey and then uses it to install Visual Studio Build Tools components, including the C++ workload. ```dockerfile # escape=` FROM mcr.microsoft.com/dotnet/framework/runtime:4.8 SHELL ["cmd", "/S", "/C"] # INSTALL chocolatey RUN \ @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile\ -InputFormat None -ExecutionPolicy Bypass\ -Command " [System.Net.ServicePointManager]::SecurityProtocol = 3072; ` iex ((New-Object System.Net.WebClient).DownloadString ` ('https://chocolatey.org/install.ps1'))" ` && ` SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin" # INSTALL Visual Studio Build Tools components (minimal) RUN \ choco install -y visualstudio2019buildtools ` --package-parameters "--quiet --wait --norestart --nocache ` --add Microsoft.VisualStudio.Workload.VCTools;includeRecommended ` --add Microsoft.VisualStudio.Workload.ManagedDesktopBuildTools` ;includeRecommended" ``` -------------------------------- ### Prepare Build Environment and Configure Project Source: https://pvs-studio.ru/ru/docs/manual/0057 Execute Coccinelle scripts, check for git diffs, set compiler flags, and configure the project build system. This includes cleaning, creating, and navigating into a build directory. ```bash script: - ./coccinelle/run-coccinelle.sh -i - git diff --exit-code - export CFLAGS="-Wall -Werror" - export LDFLAGS="-pthread -lpthread" - ./autogen.sh - rm -Rf build - mkdir build - cd build - ../configure --enable-tests --with-distro=unknown ``` -------------------------------- ### Install PVS-Studio using Rpm package Source: https://pvs-studio.ru/ru/docs/manual/0039 Installs PVS-Studio from an .rpm package using dnf, zypper, yum, or rpm commands. ```bash sudo dnf install pvs-studio-VERSION.rpm ``` ```bash sudo zypper install pvs-studio-VERSION.rpm ``` ```bash sudo yum install pvs-studio-VERSION.rpm ``` ```bash sudo rpm -i pvs-studio-VERSION.rpm ``` -------------------------------- ### Specify Configuration File Source: https://pvs-studio.ru/ru/docs/manual/0038 Use the --settings option to provide a path to a configuration file, similar to PVS-Studio.cfg, for settings like excluded directories. ```bash --settings ``` ```bash -s "PVS-Studio.cfg" ``` -------------------------------- ### V8020 corrected examples Source: https://pvs-studio.ru/ru/docs/warnings/v8020 Corrected versions of the redundant condition examples. ```text // Example N1 if A == B { if A == C { .... } } // Example N2 if A == B { .... } else { if A == C { .... } } ``` -------------------------------- ### Custom Dockerfile for PVS-Studio Source: https://pvs-studio.ru/ru/docs/manual/0047 A sample Dockerfile for setting up PVS-Studio and Visual Studio Build Tools manually using local installers. ```dockerfile # escape=` FROM mcr.microsoft.com/dotnet/framework/runtime:4.8 SHELL ["cmd", "/S", "/C"] ADD .\installers C:\Installers # INSTALL Visual Studio Build Tools components (minimal) RUN ` C:\Installers\vs_BuildTools.exe --quiet --wait --norestart --nocache ` --add Microsoft.VisualStudio.Workload.VCTools;includeRecommended ` --add Microsoft.VisualStudio.Workload.ManagedDesktopBuildTools` ;includeRecommended ` || IF "%ERRORLEVEL%"=="3010" EXIT 0 # INSTALL PVS-Studio RUN ` C:\Installers\PVS-Studio_setup.exe ` /verysilent /suppressmsgboxes /norestart /nocloseapplications # Cleanup RUN ` RMDIR /S /Q C:\Installers ``` -------------------------------- ### Disable specific diagnostic example Source: https://pvs-studio.ru/ru/docs/manual/6630?ysclid=mauu5h7en219076378 Example of disabling diagnostic V3022. ```config //-V::3022 ``` -------------------------------- ### Install Latest PVS-Studio with Chocolatey Source: https://pvs-studio.ru/ru/docs/manual/0025 Installs the latest available version of the PVS-Studio package using the Chocolatey package manager. Ensure Chocolatey is installed prior to running this command. ```bash choco install pvs-studio ``` -------------------------------- ### Redundant Logical Expression Example Source: https://pvs-studio.ru/ru/docs/warnings/v6104 An example of a redundant logical expression that can be simplified. ```java boolean firstCond, secondCond, thirdCond; .... if (firstCond || (firstCond && thirdCond)) .... ``` ```java if (firstCond) ``` ```java if (firstCond || (secondCond && thirdCond)) ``` -------------------------------- ### Run PVS-Studio Java Analyzer with Configuration File Source: https://pvs-studio.ru/ru/docs/manual/6703 Launches the Java analyzer by referencing a JSON configuration file using the `--cfg` flag. Parameters in the command line override those in the config file. ```bash java -jar pvs-studio.jar –-cfg cfg.json ``` -------------------------------- ### Malicious Input Examples Source: https://pvs-studio.ru/ru/docs/warnings/v5334 Examples of inputs used to exploit SSRF vulnerabilities. ```text admin/delete?username=testSSRF ``` ```text http://localhost/admin/delete?username=testSSRF ``` ```text http://2130706433/ = http://127.0.0.1 http://0x7f000001/ = http://127.0.0.1 ``` ```text ../admin/secure-info ``` ```text http://localhost/admin/secure-info ``` -------------------------------- ### V3151 Suppression Example Source: https://pvs-studio.ru/ru/docs/warnings/v3151 Example of using a comment to suppress the V3151 warning. ```C# 1 % num; //-V3151 ``` -------------------------------- ### Example PVS-Studio Java Analyzer Configuration File Source: https://pvs-studio.ru/ru/docs/manual/6703 An example JSON configuration file specifying source files, thread count, output details, username, and license key for the Java analyzer. ```json { "src": ["A.java", "B.java", "C.java"], "threads": 4, "output-file": "report.txt", "output-type": "text", "user-name": "someName", "license-key": "someSerial" .... } ``` -------------------------------- ### Set Up Project Environment in CircleCI Source: https://pvs-studio.ru/ru/docs/manual/0054 Downloads project sources and installs necessary build tools like CMake. This step is crucial for projects relying on external dependencies or specific build systems. ```yaml steps: # Downloading sources from the Github repository - checkout # Setting up the environment - run: sudo apt-get install -y cmake - run: sudo apt-get update - run: sudo apt-get install -y build-essential ``` -------------------------------- ### Safe Code Pattern Example Source: https://pvs-studio.ru/ru/docs/warnings/v3056 Example of code that does not trigger the V3056 warning. ```csharp array[0] = GetX() / 2; array[1] = GetX() / 2; ``` -------------------------------- ### Install PVS-Studio and Dependencies Source: https://pvs-studio.ru/ru/docs/manual/0057 Add the PVS-Studio repository, update package lists, and install necessary dependencies including PVS-Studio itself, coccinelle, and parallel build tools. ```bash before_install: - sudo add-apt-repository ppa:ubuntu-lxc/daily -y - wget -q -O - https://files.pvs-studio.com/etc/pubkey.txt |sudo apt-key add - - sudo wget -O /etc/apt/sources.list.d/viva64.list https://files.pvs-studio.com/etc/viva64.list - sudo apt-get update -qq - sudo apt-get install -qq coccinelle parallel libapparmor-dev libcap-dev libseccomp-dev python3-dev python3-setuptools docbook2x libgnutls-dev libselinux1-dev linux-libc-dev pvs-studio libio-socket-ssl-perl libnet-ssleay-perl sendemail ca-certificates ``` -------------------------------- ### Handle Conversion Example Source: https://pvs-studio.ru/ru/docs/warnings/v205 Example of casting a handle to a 32-bit unsigned integer. ```cpp HANDLE h = Get(); UINT uId = (UINT)h; ``` -------------------------------- ### V8011 Compound Assignment Examples Source: https://pvs-studio.ru/ru/docs/warnings/v8011 Examples demonstrating the problematic code and its potential corrections. ```text x -= x - 5 ``` ```text x = x - 5 ``` ```text x -= 5 ```