What Is PVS-Studio and How Does It Help Developers?

PVS-Studio is a static application security testing (SAST) tool that analyzes source code to detect programming errors, potential security vulnerabilities, and other code quality issues. The analyzer supports C, C++, C#, Java, JavaScript, TypeScript, and Go, with more than 1,300 diagnostic rules, including over 300 specialized rules. PVS-Studio integrates with development environments, build systems, continuous integration (CI) pipelines, and code quality management tools, allowing developers to incorporate static analysis into their existing workflows.

What Does PVS-Studio Detect?

PVS-Studio uses diagnostic rules to identify a wide range of issues, from simple typos to potential security vulnerabilities. Some rules are tailored to specific technologies and development standards. For example, the C analyzer includes rules designed for the Unity game engine, while the Java analyzer has a dedicated category of rules associated with the OWASP Application Security Verification Standard (ASVS).

PVS-Studio also supports software development standards such as MISRA, which aim to improve the safety, portability, and reliability of embedded software. Its diagnostic rules are mapped to security standards and vulnerability classifications, including the OWASP Application Security Verification Standard (ASVS), CERT coding standards, and the Common Weakness Enumeration (CWE), a catalog of software weaknesses.

Static analysis is particularly useful for large projects maintained by multiple developers. By identifying errors as code is written, static analysis helps developers address issues earlier and reduces back-and-forth between development and testing teams. It can also identify potential security vulnerabilities, including weaknesses that could expose an application to attacks.

Examples of Issues Found by Static Analysis

The video demonstrates how PVS-Studio detects programming errors using examples from real projects.

One example comes from the Microsoft project. The code contains nested conditional statements without curly braces, making the relationship between the if and else branches easy to misinterpret. Although the formatting suggests that the else branch belongs to the first condition, the language syntax associates it with the nearest preceding unmatched if. PVS-Studio identifies this discrepancy and issues a warning, helping developers notice code whose actual behavior may differ from its apparent intent.

Another example illustrates a potential SQL injection vulnerability. The code uses a username received from an external request to construct an SQL command without validating the input. An attacker could supply a specially crafted value containing an SQL command instead of a username, potentially gaining access to database information. PVS-Studio detects this type of risk through taint analysis, which tracks untrusted data as it moves through the program.

These examples demonstrate how static analysis can help identify both logic errors and security weaknesses directly in source code.

How Does PVS-Studio Analyze Source Code?

PVS-Studio first builds an internal representation of the source code called an abstract syntax tree (AST). The analyzer then applies diagnostic rules to this representation using several static analysis techniques.

Signature analysis, also known as pattern matching, searches for code patterns associated with known types of errors. It helps detect suspicious code fragments that resemble established error patterns.

Symbolic execution evaluates possible variable values and their ranges to identify situations that could lead to errors. This technique helps determine whether particular values or execution paths could produce unexpected behavior.

Type inference provides information about the types of variables and expressions in the program. This information helps the analyzer interpret operations and evaluate code more accurately.

Data flow analysis examines how values and constraints propagate through program constructs. For example, it can determine which values a variable may have within if and else branches, helping identify conditions that may lead to incorrect behavior.

Taint analysis tracks data originating from untrusted sources, such as user input. By following this data through the program, the analyzer can detect potentially dangerous operations, including SQL commands constructed from unvalidated external input.

Method annotations provide additional information about methods and their behavior. PVS-Studio includes annotations for many popular libraries and also allows developers to create their own annotations in JSON format.

Intermodular analysis enables diagnostic rules to examine functions declared in other translation units. This allows the analyzer to use information across source files when checking code.

Together, these techniques help PVS-Studio identify different classes of programming errors and potential vulnerabilities.

Integrations With Development Tools

PVS-Studio supports a range of development environments and build systems. Its plugins are available for Visual Studio, IntelliJ IDEA, Rider, CLion, WebStorm, PhpStorm, GoLand, Visual Studio Code, and Qt Creator.

The analyzer works with build systems such as MSBuild, CMake, Make, Ninja, Gradle, and Maven. It can also analyze projects built with compilers that generate a compile_commands.json file. Distributed builds are supported through Incredibuild.

For game development, PVS-Studio provides integrations with Unity and Unreal Engine. Embedded software developers can use the analyzer with tools including Keil µVision, DS-5 Development Studio, IAR Embedded Workbench, QNX Momentics, and TI ARM Code Generation Tools.

PVS-Studio analysis reports can be integrated with code quality and security tools such as SonarQube, DefectDojo, and CodeChecker. For report management, PVS-Studio Atlas offers two options: the Atlas viewer for reviewing an individual analysis report and the Atlas server for working with reports from static analyzers in a multi-user environment.

Static analysis can also be automated in CI pipelines using Jenkins, TeamCity, CircleCI, Travis CI, GitLab, Azure DevOps, and GitHub Actions. PVS-Studio supports virtualization and development environments based on Docker and Windows Subsystem for Linux (WSL).

Tools for Managing Analysis Results

PVS-Studio includes additional utilities that help developers process analysis results and communicate findings. PlogConverter converts analyzer reports into other formats, including standardized formats used by external tools. Blame Notifier sends customized warning emails to the developers responsible for the relevant code, helping teams direct issues to the appropriate people.

The video presents PVS-Studio as a static analysis tool that combines multiple analysis techniques with integrations for development environments, build systems, security tools, and CI pipelines. Developers can use it to detect programming errors and potential vulnerabilities, review analysis reports, and incorporate code analysis into established development workflows.