Use PVS-Studio to Increase the Reliability and Security of Financial Software

Sep 01 2017

Author: Andrey Karpov

Among our clients some organizations involved in developing software in the field of finance are gradually starting to appear. We have many articles on different topics, but we somehow unfairly spared the scope of finance. We shall try to mend and eventually write some articles, and I'll begin with a little story.

Introductory paragraph for those who are not familiar with PVS-Studio tool. PVS-Studio static code analyzer is designed to detect errors and potential vulnerabilities in code written in C#, C, C++ languages and dialects of the C++ language, such as C++/CLI and C++/CX (WinRT). It works in Windows and Linux environment. At the moment, PVS-Studio is one of the most powerful tools in the class of static analyzers and it can detect many types of defects. We suggest to get acquainted both with the list of warnings, and the examples of using the analyzer.

PVS-Studio allows to detect many errors right after they appeared. The faster an error is detected, the cheaper it is to correct it. For example, here's the way the cost of security defect grows according to NIST:

PVS-Studio analyzer is extremely in demand in those spheres where any error can lead to a great loss of time or money. One of such spheres of software development is the financial sector. For example, it is about trading and banking software. We see a gradual increase in interest from teams, serving financial companies and they began to add to the list of our clients of financial sector. However, we need to pay more attention to this area and this article is the first swallow.

Now I will tell you a promised story. The analyzer includes V3040 diagnostic that detects a situation when one integer value is divided by another integer value and the result is placed in a variable of float or double type. Of course, similar code is not always wrong, but it is definitely suspicious and requires code review.

Someone believes that a similar error is far-fetched and a warning V3040 will often be false. He might be right, and wrong. It all depends on the type of application and from what, in fact, the program evaluates.

One man said that the team, where he worked, has found a very nasty bug in their software using this diagnostic. I can not tell, where this person works, because the story was shared with me on the condition of anonymity (no, it was not a bank).

The module in which the bug was found, counted flexible prices for different options and conditions of orders. In other words, it counted what price a sales manages should say to a potential client. The error crept into the account of a certain rate. Integer division was used where it must not be used:

double K;
....
if (foo)
  K = 200 / 95;
else
....

I will tell at once that I thought of this code and I don't know how it was designed. The idea is that instead of the multiplier of 2.1, rate 2 has turned out. As a result, managers began dialogue with the client, making a price slightly lower than it supposed to be. Price was calculated wrong only when a certain combination of conditions, so no one ever noticed a mistake, relying on those numbers, which were issued by the program.

As I said, this coefficient was calculated wrong only in rare cases, this error did not harm the company's revenue. However, the error was so unpleasant for developers that they decided to hide its discovery from a senior manager and just quietly fixed the code.

Let us leave aside the question of rightness of these programmers' behavior. It is much more interesting that a very simple integer division error leads to consequences that are shameful to tell to superiors.

As you can see, even simple mistakes can cause loss of time, money, and reputation. If we are talking about more significant software, then errors can come at extremely high cost. Those who develop software for finance, use an integrated approach for reliability. Static PVS-Studio analyzer can become a great addition to the set of measures to control the quality of your code.

I suggest to all who care about the quality of the code, immediately download and try PVS-Studio. It will find your errors, and you'll be overwhelmed by that luck why the program actually worked :). It's better to detect many errors using analyzer, but not with the help of your clients, and certainly not by hackers.

In addition, reports of PVS-Studio can be very nice to show for superiors, having integrated them with the SonarQube tool.