Macro Evil in C++ Code—Andrey Karpov
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
Their usefulness dwindles with time.
Macro Evil in C++ Code by Andrey Karpov
From the article:
The C++ language opens extensive opportunities to go without macros. So let’s try to use macros as seldom as possible!
#News,Articles&_Books,
Macro Evil in C++ Code
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
The C++ language opens extensive opportunities to go without macros. So let’s try to use macros as seldom as possible!
Macro Evil in C++ Code by Andrey Karpov
From the article:
The ATL library provides such macros, as A2W, T2W and so on for string conversion. However, few people know that it is very dangerous to use these macros inside loops. Within the macro, a call to the alloca function occurs, which will repeatedly allocate memory on each loop iteration on the stack. A program makes show that it works correctly. Once a program starts to handle longer strings and the number of loop iterations increases, the stack can just end at the most unexpected (...)
Free PVS-Studio for those who develops open source projects
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
On the New 2019 year’s eve, a PVS-Studio team decided to make a nice gift for all contributors of open-source projects hosted on GitHub or Bitbucket. They are given free usage of PVS-Studio static analyzer for development of open source projects.
Free PVS-Studio for those who develops open source projects by Andrey Karpov
From the article:
Everyone who wishes, can get a free license for 1 year. To get the license, you need to: Go to the page: ▻https://www.viva64.com/en/open-source-license Enter the e-mail, where you will be sent a license key; Enter the link to your GitHub/Bitbucket profile; Send a request for a free (...)
PVS-Studio: Support of MISRA C and MISRA C++ Coding Standards
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
Starting with the version 6.27, the PVS-Studio static code analyzer can classify its warnings according to MISRA C and MISRA C++ standards. Due to support of these standards it has become possible to effectively use the analyzer to increase the level of security, portability and reliability of programs for embedded systems.
PVS-Studio: Support of MISRA C and MISRA C++ Coding Standards by Andrey Karpov
From the article:
Such diagnosis can’t be applied to already existing projects developed for Windows, Linux or macOS operating systems. For example, only one rule about curly brackets described above gives 1947 warnings of the V2507 diagnostic (MISRA C 15.6, MISRA C++ 6-4-1) for a WinMerge project. Still WinMerge is a small project! In total, only 250 000 lines of code (...)
Technologies used in the PVS-Studio code analyzer for finding bugs and potential vulnerabilities
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
The PVS-Studio analyzer is gradually becoming more complicated but these changes can be hardly described in a Release-history. For example, this year we have consistently implemented symbolic computations in the analyzer. This is why it was agreed to write a note on algorithms and technologies, which PVS-Studio now uses to search for errors and potential vulnerabilities.
Technologies used in the PVS-Studio code analyzer for finding bugs and potential vulnerabilities by Andrey Karpov
From the article:
Here a mixture of technologies is working: data flow analysis, symbolic execution, and automatic method annotation (we will cover this technology in the next section). The analyzer sees that X variable is used in the Div function as a divisor. On this basis, a special (...)
Android Operating System: One Potential Vulnerability per 4000 Lines of C++ Code
▻https://hownot2code.com/2018/09/07/android-operating-system-one-potential-vulnerability-per-4000-lines-of-
For many years, Andrey Karpov has been publishing articles on code quality, and bugs reviews of open source projects. For example, he is the author of such publications as “The Ultimate Question of Programming, Refactoring, and Everything” and “27 000 Errors in the Tizen Operating System“. Recently, the open source Android operating system has … Continue reading Android Operating System: One Potential Vulnerability per 4000 Lines of C++ Code
►https://1.gravatar.com/avatar/a7fa0bb4ebff5650d2c83cb2596ad2aa?s=96&d=identicon&r=G
PVS-Studio 6.26 Released
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
This new release included many interesting improvements related to analysis of C and C++ code, about which we’d like to tell our users.
PVS-Studio 6.26 Released by Andrey Karpov
From the article:
A developer believes that this is a bug in the compiler. Nevertheless, it is the author of the code who is wrong. The function does not work correctly due to the fact that undefined behavior occurs in it. The compiler follows that in the r variable a certain sum is calculated. Overflow of the r variable must not happen. Otherwise, it is undefined behavior, which doesn’t have to be considered or taken into account by a compiler. So, the compiler thinks that since the value of r variable after ending the loop cannot be negative, then r & 0x7fffffff operation is not (...)
PVS-Studio as SAST solution
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
PVS-Studio is a static application security testing tool (SAST). In other words, the PVS-Studio analyzer detects not only typos, dead code and other errors, but also security weaknesses (potential vulnerabilities).
PVS-Studio as SAST solution by Andrey Karpov
From the article:
Until recently, in our articles we have positioned PVS-Studio as a tool for detecting errors in code. While we almost never regarded PVS-Studio in a security context. We will try to remedy this situation and take a look at the tool in terms of testing of security applications and DevSecOps practices. For the convenience of specialists who will use PVS-Studio as a SAST tool, the analyzer provides mappings for its warnings to Common Weakness Enumeration, SEI CERT Coding Standards, and also (...)
PVS-Studio 6.24 released
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
A new release of the PVS-Studio static code analyzer became available to download. This tool is designed to detect errors and potential vulnerabilities in the source code of programs, written in C, C++, and C#.
PVS-Studio 6.24 released by Andrey Karpov
From the article:
Support for Texas Instruments Code Composer Studio, ARM compiler was added under Windows\Linux. 8 new diagnostics were introduced to detect errors in C and C++ code. In addition to the development of new diagnostics, we continue improving Data-Flow analysis that enables old diagnostics find more bugs. Thanks to these improvements, the analyzer finds more interesting errors, like the one we described in the article “February 31”. Download and try (...)
PVS-Studio is now available on macOS: 64 weaknesses in the Apple’s XNU Kernel
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
A new version of PVS-Studio analyzer 6.23 is working under macOS, which allows you to check the projects written in C and C++. Our team decided perform a XNU Kernel check to coincide it with this event.
PVS-Studio is now available on macOS: 64 weaknesses in the Apple’s XNU Kernel by Andrey Karpov
From the article:
Although the XNU Kernel is relatively small, it’s a challenge to study the analyzer warnings alone, which takes much time. False positives make the check more complicated, since I haven’t performed the preliminary analyzer configuration. I just quickly looked through the warnings, writing out code fragments that, in my opinion, represent interest. This is more than enough for writing a quite large article. PVS-Studio analyzer easily finds a large (...)
Static Code Analyzer PVS-Studio 6.22 Now Supports ARM Compilers (Keil, IAR)
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
Now our articles have every chance to become even more interesting because PVS-Studio can now check the code of embedded devices. We have added support for a few ARM compilers, which I talk about in detail below.
Static Code Analyzer PVS-Studio 6.22 Now Supports ARM Compilers (Keil, IAR) by Andrey Karpov
From the article:
I find the RT-Thread operating system a perfect candidate to be the first embedded system checked with PVS-Studio. I glanced through the analysis report by PVS-Studio and picked 95 warnings that I thought to be the most interesting ones. Too see all those messages for yourself, download the rt-thread-html-log.zip archive with the full HTML report. We introduced this format not so long ago, and some users may not know about it. So, I’d like to use (...)
Why it is important to check what the malloc function returned
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
Unfortunately, many programmers are careless about checking of pointers, and sometimes they deliberately do not check whether to memory was allocated or not.
Why it is important to check what the malloc function returned by Andrey Karpov
From the article:
There are 4 reasons at once, each of them is enough to prove that it is so necessary to write a check after you call the malloc function. If someone from your team doesn’t write the checks, make him read this article. Null pointer dereference is undefined behavior Null pointer dereference is a vulnerability Where are guarantees that dereferencing of exactly a null pointer will occur? Where are the guarantees that memset fills the memory in a direct (...)
break and fallthrough—Andrey Karpov
▻http://isocpp.org/feeder/?FeederAction=clicked&feed=All+Posts&seed=http%3A%2F%2Fisocpp.org%2Fblog%2F2
A classic error:
break and fallthrough by Andrey Karpov
From the article:
We would like to suggest reading the series of articles dedicated to the recommendations on writing code of high quality using the examples of errors found in the Chromium project. This is the second part, which will be devoted to the switch operator and, more precisely, to the problem of a forgotten break operator...
#News,Articles&_Books,