PVS-Studio

PVS-Studio
Name	PVS-Studio
Developer	Program Verification Systems
Released	2008
Operating system	Microsoft Windows, Linux, macOS
Language	English, Russian
License	Commercial proprietary

PVS-Studio is a commercial static code analysis tool developed by Program Verification Systems for detecting bugs and potential vulnerabilities in source code. It performs pattern-based and heuristic analysis across multiple languages and integrates with a range of development environments used by organizations such as Microsoft, Google, Amazon, Intel, and ARM Holdings. The analyzer is commonly cited in case studies alongside tools from Coverity, SonarQube, Fortify (software), and Lint (software).

Overview

PVS-Studio originated as a product targeting C and C++ ecosystems and expanded to support additional languages and platforms, aiming to assist teams using toolchains from GCC, Clang, Microsoft Visual Studio, and LLVM. The project has been discussed in conferences and publications alongside research from ACM, IEEE, Black Hat, and DEF CON. Its vendor provides documentation, blog posts, and examples comparing static analysis results with outputs from Valgrind, AddressSanitizer, and UndefinedBehaviorSanitizer.

Features and Technology

The analyzer implements rule-based detection, pattern matching, and flow analysis to identify issues such as null dereferences, uninitialized variables, and dead code, comparable to techniques described in papers from USENIX, SOSP, PLDI, and OOPSLA. It includes diagnostic severities, suppressions, and reporting formats compatible with standards from ISO/IEC and integrates with continuous inspection practices promoted by projects like Jenkins (software), Travis CI, and GitHub Actions. The engine supports cross-module analysis, dataflow tracking, and heuristics refined through case studies involving companies such as Siemens, Bosch, and Honeywell.

Supported Platforms and Languages

The tool provides analysis for source bases written in C, C++, C#, and in later iterations added support for Java and other languages through plugins, aligning with ecosystems that include Eclipse, JetBrains, IntelliJ IDEA, and Visual Studio Code. It runs on Windows NT variants, various distributions of Linux such as Ubuntu, Red Hat Enterprise Linux, and on macOS for selected components. The product is often evaluated in comparison with language-specific analyzers used by teams at Facebook, Apple Inc., and NVIDIA.

Integration and Tooling

Integration points include plug-ins for Microsoft Visual Studio, extensions for JetBrains CLion, command-line interfaces for inclusion in Bazel, CMake, and Make (software), and connectors for continuous integration servers like TeamCity, CircleCI, and Azure DevOps. Reporting outputs can be exported to formats used by SonarQube, ELK Stack, and JIRA (software) for issue tracking and triage workflows adopted by enterprises such as SAP, Oracle, and Salesforce. The vendor provides a set of SDKs and API hooks similar to offerings from GitLab and Bitbucket for automation and custom pipelines.

Commercial Licensing and Editions

The product is distributed under proprietary commercial licenses with edition tiers aimed at individual developers, small teams, and enterprise deployments, echoing licensing models used by Red Hat, SUSE, and Microsoft Corporation. License options include subscription plans, floating seats, and site licenses, and the company offers evaluation licenses similar to practices at JetBrains and Perforce Software. Pricing and enterprise support models are adapted for sectors including Aerospace, Automotive, and Telecommunications where compliance with standards from ISO 26262, DO-178C, and MISRA is often required.

Reception and Use in Industry

Adoption has been reported in industries with high-reliability requirements, including teams at Bosch, Continental AG, and Thales Group, and in open-source audits comparable to reviews performed by Mozilla Foundation and Apache Software Foundation. Independent researchers and practitioners have published analyses comparing detection rates and false-positive profiles against tools such as Cppcheck, Flawfinder, and RATS (software), and the product has been mentioned in vulnerability disclosures cataloged by organizations like CVE and discussed at events like RSA Conference and SANS Institute trainings. Academic and industrial feedback highlights strengths in pattern coverage and integration flexibility while noting trends similar to those reported for competing static analyzers in terms of tuning and rule customization.

Category:Static program analysis tools Category:Proprietary software