Open source *

Open source software

SvyatoslavMC Dec 17 2020 at 07:01

ONLYOFFICE Community Server: how bugs contribute to the emergence of security problems

12 min

PVS-Studio corporate blog.NET * C# * Open source * Information Security *

Server-side network applications rarely get the chance to join the ranks of our reviews of errors found in open source software. This is probably due to their popularity. After all, we try to pay attention to the projects that readers themselves offer us. At the same time, servers often perform very important functions, but their performance and benefits remain invisible to most users. So, by chance, the code of ONLYOFFICE Community Server was checked. It turned out to be a very fun review.

IchNikola Dec 16 2020 at 07:47

Talking About Errors in the QuantConnect Lean Code

17 min

476

PVS-Studio corporate blog.NET * C# * Open source *

This article discusses errors found using a static analyzer in an open source project. There are some simple things that can help you avoid them. For example, the usage of language syntactic constructs starting from C# 8.0. We hope it will be exciting. Have fun reading!

SvyatoslavMC Nov 27 2020 at 06:54

Analyzing the Code Quality of Microsoft's Open XML SDK

10 min

PVS-Studio corporate blogDevelopment for Office 365 * Open source * C# * .NET *

My first encounter with Open XML SDK took place when I was looking for a library that I could use to create some accounting documents in Word. After more than 7 years of working with Word API, I wanted to try something new and easier-to-use. That's how I learned that Microsoft offered an alternative solution. As tradition has it, before our team adopts any program or library, we check them with the PVS-Studio analyzer.

-1

Andrey2008 Oct 27 2020 at 11:36

Checking Clang 11 with PVS-Studio

10 min

1.1K

PVS-Studio corporate blogC++ * Open source * Information Security * Compilers *

Every now and then, we have to write articles about how we've checked another fresh version of some compiler. That's not really much fun. However, as practice shows, if we stop doing that for a while, folks start doubting whether PVS-Studio is worth its title of a good catcher of bugs and vulnerabilities. What if the new compiler can do that too? Sure, compilers evolve, but so does PVS-Studio – and it proves, again and again, its ability to catch bugs even in high-quality projects such as compilers.

Andrey2008 Oct 22 2020 at 08:39

Checking a Header-Only C++ Library Collection (awesome-hpp)

17 min

1.3K

PVS-Studio corporate blogOpen source * C++ *

Somehow, we've happened to check most of the libraries making up a collection called "Awesome hpp". These are small header-only projects in C++. Hopefully, the information about the bugs we've found will help make the libraries better. We'll also be happy to see the developers use PVS-Studio on a regular basis thanks to the free-license option we provide.

vkhanieva Oct 21 2020 at 07:08

Amnesia: The Dark Descent or How to Forget to Fix Copy Paste

14 min

842

PVS-Studio corporate blogGame development * Open source * C++ *

Just before the release of the "Amnesia: Rebirth" game, the vendor "Fractional Games" opened the source code of the legendary "Amnesia: The Dark Descent" and its sequel "Amnesia: A Machine For Pigs". Why not use the static analysis tool to see what dreadful mistakes are hidden in the inside of these cult horror games?

basiliscos Oct 8 2020 at 11:31

What's new in rotor v0.09

8 min

2.1K

Crazy Panda corporate blogC++ * Open source * Programming *

From sandbox

actor system

rotor is a non-intrusive event loop friendly C++ actor micro framework, similar to its elder brothers like caf and sobjectizer. The new release came out under the flag of pluginization, which affects the entire lifetime of an actor.

revusky Oct 1 2020 at 15:37

JavaCC 21 Parser Generator

4 min

2.9K

Java * Open source *

From sandbox

JavaCC 21 is a continuation of work on the venerable JavaCC parser generator, originally developed at Sun Microsystems in the 1990’s and released under a liberal open source license in 2003. It is currently the most advanced version of JavaCC. It has many feature enhancements (with more to come soon) and also generates much more modern, readable Java code. Also, certain key bugs have finally been fixed. (N.B. The “21” in JavaCC 21 is not a version number. It is simply part of the project name and means that this is a JavaCC for the 21st century!)

Andrey2008 Sep 24 2020 at 09:36

Why it is important to apply static analysis for open libraries that you add to your project

7 min

932

PVS-Studio corporate blogPerfect code * Programming * Open source * C++ *

PVS-Studio and Awesome header-only C++ libraries

Modern applications are built from third-party libraries like a wall from bricks. Their usage is the only option to complete the project in a reasonable time, spending a sensible budget, so it's a usual practice. However, taking all the bricks indiscriminately may not be such a good idea. If there are several options, it is useful to take time to analyze open libraries in order to choose the best one.

-1

S0mbre Sep 21 2020 at 06:34

Crime, Race and Lethal Force in the USA — Part 3

24 min

Python * Open source * Data Mining * Big Data *

Translation

This is the concluding part of my article devoted to a statistical analysis of police shootings and criminality among the white and the black population of the United States. In the first part, we talked about the research background, goals, assumptions, and source data; in the second part, we investigated the national use-of-force and crime data and tracked their connection with race.

S0mbre Sep 18 2020 at 02:00

Crime, Race and Lethal Force in the USA — Part 2

14 min

2.5K

Big Data * Data Mining * Open source * Python *

Translation

In the previous part of this article, I talked about the research background, goals, assumptions, source data, and used tools. Today, without further ado, let's say together…

S0mbre Sep 18 2020 at 02:00

Crime, Race and Lethal Force in the USA — Part 1

8 min

2.9K

Python * Open source * Data Mining *

Translation

Do the police in the US really shoot black people more often than white people? Is use of lethal force connected with race? How is crime related to race? What are the odds of getting shot by the police if you are white and if you are black? We're taking public data and python with pandas to shed some light on these questions, propaganda and politics set far aside.

eugeneovsyannikov Sep 4 2020 at 06:47

Checking QEMU using PVS-Studio

14 min

695

PVS-Studio corporate blogC * C++ * Open source * Programming *

QEMU is a rather well-known application for emulation. Static analysis can help developers of complex projects such as QEMU catch errors at early stages and generally improve quality and reliability of a project. In this article, we will check the source code of the QEMU application for potential vulnerabilities and errors using the PVS-Studio static analysis tool.

stefanbuzz Aug 28 2020 at 13:13

Checking the Code of XMage, and Why You Won't Be Able to Get the Special Rare Cards of the Dragon's Maze Collection

13 min

766

PVS-Studio corporate blogGame development * Open source * Java *

XMage is a client-server application for playing Magic: The Gathering (MTG). XMage's development was started in early 2010. Since then, it has seen 182 releases, attracted an army of contributors, and it's still being actively developed even now. All that makes it a good reason for us to contribute to its development too! So, today the PVS-Studio unicorn is going to check the code base of XMage and maybe even get into a fight with some entities.

Andrey2008 Aug 19 2020 at 08:31

Static code analysis of the PMDK library collection by Intel and errors that are not actual errors

14 min

867

PVS-Studio corporate blogC * C++ * Open source * Information Security *

We were asked to check a collection of open source PMDK libraries for developing and debugging applications with NVRAM support by PVS-Studio. Well, why not? Moreover, this is a small project in C and C++ with a total code base size of about 170 KLOC without comments. Which means, the results review won't take much energy and time. Let's go.

Firensis Aug 13 2020 at 08:08

Unicorns break into RTS: analyzing the OpenRA source code

16 min

773

PVS-Studio corporate blogC# * Open source * Games and game consoles

This article is about the check of the OpenRA project using the static PVS-Studio analyzer. What is OpenRA? It is an open source game engine designed to create real-time strategies. The article describes the analysis process, project features, and warnings that PVS-Studio has issued. And, of course, here we will discuss some features of the analyzer that made the project checking process more comfortable.

SvyatoslavMC Jul 13 2020 at 06:30

The Code of the Command & Conquer Game: Bugs from the 90's. Volume two

13 min

3.5K

PVS-Studio corporate blogC * C++ * Open source * Game development *

The American company Electronic Arts Inc (EA) has opened the source code of the games Command & Conquer: Tiberian Dawn and Command & Conquer: Red Alert publicly available. Several dozen errors were detected in the source code using the PVS-Studio analyzer, so, please, welcome the continuation of found defects review.

SvyatoslavMC Jun 18 2020 at 06:26

The Code of the Command & Conquer Game: Bugs From the 90's. Volume one

13 min

2.1K

PVS-Studio corporate blogC * C++ * Open source * Game development *

The American company Electronic Arts Inc (EA) has made the source code of the games Command & Conquer: Tibetan Dawn and Command & Conquer: Red Alert publicly available. This code should help the game community to develop mods and maps, create custom units, and customize the gameplay logic. We all now have a unique opportunity to plunge into the history of development, which is very different from the modern one. Back then, there was no StackOverflow site, convenient code editors, or powerful compilers. Moreover, at that time, there were no static analyzers, and the first thing the community will face is hundreds of errors in the code. This is what the PVS-Studio team will help you with by pointing out the erroneous places.

NLazeba Jun 1 2020 at 08:41

NSA, Ghidra, and Unicorns

12 min

1.1K

PVS-Studio corporate blogJava * Open source * Reverse engineering *

This time, the PVS-Studio team's attention was attracted by Ghidra, a big bad reverse-engineering framework allowing developers to analyze binary files and do horrible things to them. The most remarkable fact about it is not even that it's free and easily extensible with plugins but that it was developed and uploaded to GitHub for public access by NSA. On the one hand, you bet NSA has enough resources for keeping their code base clean. On the other hand, new contributors, who are not well familiar with it, may have accidentally introduced bugs that could stay unnoticed. So, we decided to feed the project to our static analyzer and see if it has any code issues.

IchNikola May 28 2020 at 14:35

Single line code or check of Nethermind using PVS-Studio C# for Linux

14 min

PVS-Studio corporate blog.NET * C# * Open source * Development for Linux *

This article coincides with the beta testing start of PVS-Studio C# for Linux, as well as the plugin for Rider. For such a wonderful reason, we checked the source code of the Nethermind product using these tools. This article will cover some distinguished and, in some cases, funny errors.

1 2 3

5 6 7 8