Pull to refresh
278.54

Open source *

Open source software

Show first
Rating limit
Level of difficulty

Checking Telegram Open Network with PVS-Studio

Reading time 7 min
Views 1.3K

Picture 3

Telegram Open Network (TON) is a platform by the same team that developed the Telegram messenger. In addition to the blockchain, TON provides a large set of services. The developers recently made the platform's code, which is written in C++, publicly available and uploaded it to GitHub. We decided to check the project before its official release.
Read more →
Total votes 30: ↑28 and ↓2 +26
Comments 0

Celestia: Bugs' Adventures in Space

Reading time 6 min
Views 968
Picture 1

Celestia is a three-dimensional space simulator. Simulation of the space allows exploring our universe in three dimensions. Celestia is available on Windows, Linux and macOS. The project is very small and PVS-Studio detected few defects in it. Despite this fact, we'd like to pay attention to it, as it's a popular educational project and it will be rather useful to somehow improve it. By the way, this program is used in popular films, series and programs for showing space. This fact, in turns, raises requirements to the code quality.
Read more →
Total votes 27: ↑25 and ↓2 +23
Comments 0

Dark theme of Thunderbird as a reason to run a code analyzer

Reading time 12 min
Views 2K
Picture 3
The adventures with the Mozilla Thunderbird mail client began with automatic update to version 68.0. More text in pop-up notifications and default dark theme are the notable features of this version. Occasionally I found an error that I immediately craved to detect with static analysis. This became the reason to go for another check of the project source code using PVS-Studio. It so happened that by the time of the analysis, the bug had already been fixed. However, since we've paid some attention to the project, there's no reason not to write about other found defects.

Introduction


The dark theme of the new Thunderbird version looks pretty. I like dark themes. I've already switched to them in messengers, Windows, macOS. Soon iPhone will be updated to iOS 13 with a dark theme. For this reason I even had to change my iPhone 5S for a newer model. In practice, it turned out that a dark theme requires more effort for developers to pick up the colors of the interface. Not everyone can handle it the first time.
Read more →
Total votes 28: ↑26 and ↓2 +24
Comments 0

Important Things to Know About Tensorflow 2.0

Reading time 5 min
Views 3K


Deep Learning applications have changed a lot of things. Some which give hope for a brighter future, and some which raise suspicions. However, for developers, the growth of deep learning applications has made them more perplexed about choosing the best among so many deep learning frameworks out there.

TensorFlow is one of the deep learning frameworks that comes in mind. It is arguably the most popular deep learning framework out there. Nothing justifies the statement better than the fact that Tensorflow is used by the likes of Uber, Nvidia, Gmail among other big corporations for developing state-of-the-art deep learning applications.

But right now, I am on a quest to find whether it indeed is the best deep learning framework. Or perhaps find what makes it the best out of all other frameworks it competes against.
Read more →
Total votes 14: ↑11 and ↓3 +8
Comments 0

Analysis of the Apache Dubbo RPC Framework by the PVS-Studio Static Code Analyzer

Reading time 9 min
Views 1.4K

Picture 2

Apache Dubbo is one of the most popular Java projects on GitHub. It's not surprising. It was created 8 years ago and is widely applied as a high-performance RPC environment. Of course, most of the bugs in its code have long been fixed and the quality of the code is maintained at a high level. However, there is no reason to opt out of checking such an interesting project using the PVS-Studio static code analyzer. Let's see how it turned out.
Read more →
Total votes 25: ↑24 and ↓1 +23
Comments 0

How to set up PVS-Studio in Travis CI using the example of PSP game console emulator

Reading time 11 min
Views 670

PPSSPP

Travis CI is a distributed web service for building and testing software that uses GitHub as a source code hosting service. In addition to the above scripts, you can add your own, thanks to the extensive configuration options. In this article we will set up Travis CI for working with PVS-Studio by the example of PPSSPP code.
Read more →
Total votes 26: ↑24 and ↓2 +22
Comments 0

An Easy Way to Make Money on Bug Bounty

Reading time 5 min
Views 5K

Рисунок 2


Surely you've heard the expression «bug hunting» many times. I dare to assume, you won't mind earning one or two hundred (or even thousand) dollars by finding a potential vulnerability in someone's program. In this article, I'll tell you about a trick that will help analyzing open source projects in order to find such vulnerabilities.
Read more →
Total votes 24: ↑20 and ↓4 +16
Comments 0

CMake: the Case when the Project's Quality is Unforgivable

Reading time 11 min
Views 2K

Picture 1

CMake is a cross-platform system for automating project builds. This system is much older than the PVS-Studio static code analyzer, but no one has tried to apply the analyzer on its code and review the errors. As it turned out, there are a lot of them. The CMake audience is huge. New projects start on it and old ones are ported. I shudder to think of how many developers could have had any given error.
Read more →
Total votes 25: ↑23 and ↓2 +21
Comments 0

PVS-Studio Visits Apache Hive

Reading time 12 min
Views 1.2K
Рисунок 1

For the past ten years, the open-source movement has been one of the key drivers of the IT industry's development, and its crucial component. The role of open-source projects is becoming more and more prominent not only in terms of quantity but also in terms of quality, which changes the very concept of how they are positioned on the IT market in general. Our courageous PVS-Studio team is not sitting idly and is taking an active part in strengthening the presence of open-source software by finding hidden bugs in the enormous depths of codebases and offering free license options to the authors of such projects. This article is just another piece of that activity! Today we are going to talk about Apache Hive. I've got the report — and there are things worth looking at.
Read more →
Total votes 23: ↑20 and ↓3 +17
Comments 0

Checking the .NET Core Libraries Source Code by the PVS-Studio Static Analyzer

Reading time 59 min
Views 1.7K

Picture 19

.NET Core libraries is one of the most popular C# projects on GitHub. It's hardly a surprise, since it's widely known and used. Owing to this, an attempt to reveal the dark corners of the source code is becoming more captivating. So this is what we'll try to do with the help of the PVS-Studio static analyzer. What do you think – will we eventually find something interesting?
Read more →
Total votes 28: ↑25 and ↓3 +22
Comments 1

The story of how PVS-Studio found an error in the library used in… PVS-Studio

Reading time 3 min
Views 1.2K

Picture 1

This is a short story about how PVS-Studio helped us find an error in the source code of the library used in PVS-Studio. And it was not a theoretical error but an actual one — the error appeared in practice when using the library in the analyzer.
Read more →
Total votes 27: ↑24 and ↓3 +21
Comments 0

PVS-Studio Looked into the Red Dead Redemption's Bullet Engine

Reading time 10 min
Views 4.5K
Picture 4

Nowadays there is no need to implement the physics of objects from scratch for game development because there are a lot of libraries for this purpose. Bullet was actively used in many AAA games, virtual reality projects, various simulations and machine learning. And it is still used, being, for example, one of the Red Dead Redemption and Red Dead Redemption 2 engines. So why not check the Bullet with PVS-Studio to see what errors static analysis can detect in such a large-scale physics simulation project.
Read more →
Total votes 34: ↑31 and ↓3 +28
Comments 0

Almost Perfect Libraries by Electronic Arts

Reading time 4 min
Views 5.6K
Our attention was recently attracted by the Electronic Arts repository on GitHub. It's tiny, and of the twenty-three projects available there, only a few C++ libraries seemed interesting: EASTL, EAStdC, EABase, EAThread, EATest, EAMain, and EAAssert. The projects themselves are tiny too (about 10 files each), so bugs were found only in the «largest» project of 20 files :D But we did find them, and they do look interesting! As I was writing this post, we were also having a lively discussion of EA games and the company's policy :D

Picture 1

Read more →
Total votes 24: ↑22 and ↓2 +20
Comments 0

Best Copy-Paste Algorithms for C and C++. Haiku OS Cookbook

Reading time 14 min
Views 1.1K
Numerous typos and Copy-Paste code became the main topic of the additional article about checking the Haiku code by the PVS-Studio analyzer. Yet this article mostly tells about errors related to thoughtlessness and failed refactoring, rather than to typos. The errors found demonstrate how strong the human factor is in software development.

Picture 1
Read more →
Total votes 16: ↑13 and ↓3 +10
Comments 0

How to shoot yourself in the foot in C and C++. Haiku OS Cookbook

Reading time 20 min
Views 2.9K
The story of how the PVS-Studio static analyzer and the Haiku OS code met goes back to the year 2015. It was an exciting experiment and useful experience for teams of both projects. Why the experiment? At that moment, we didn't have the analyzer for Linux and we wouldn't have it for another year and a half. Anyway, efforts of enthusiasts from our team have been rewarded: we got acquainted with Haiku developers and increased the code quality, widened our error base with rare bugs made by developers and refined the analyzer. Now you can check the Haiku code for errors easily and quickly.
Picture 1

Read more →
Total votes 18: ↑17 and ↓1 +16
Comments 1

A declarative data-processing pipeline on top of actors? Why not?

Reading time 21 min
Views 2.6K

Some time ago, in a discussion on one of SObjectizer's releases, we were asked: "Is it possible to make a DSL to describe a data-processing pipeline?" In other words, is it possible to write something like that:


A | B | C | D


and get a working pipeline where messages are going from A to B, and then to C, and then to D. With control that B receives exactly that type that A returns. And C receives exactly that type that B returns. And so on.


It was an interesting task with a surprisingly simple solution. For example, that's how the creation of a pipeline can look like:


auto pipeline = make_pipeline(env, stage(A) | stage(B) | stage(C) | stage(D));

Or, in a more complex case (that will be discussed below):


auto pipeline = make_pipeline( sobj.environment(),
        stage(validation) | stage(conversion) | broadcast(
            stage(archiving),
            stage(distribution),
            stage(range_checking) | stage(alarm_detector{}) | broadcast(
                stage(alarm_initiator),
                stage( []( const alarm_detected & v ) {
                        alarm_distribution( cerr, v );
                    } )
                )
            ) );

In this article, we'll speak about the implementation of such pipeline DSL. We'll discuss mostly parts related to stage(), broadcast() and operator|() functions with several examples of usage of C++ templates. So I hope it will be interesting even for readers who don't know about SObjectizer (if you never heard of SObjectizer here is an overview of this tool).

Read more →
Total votes 12: ↑11 and ↓1 +10
Comments 2

Why LLVM may call a never called function?

Reading time 11 min
Views 6.6K
I don’t care what your dragon’s said, it’s a lie. Dragons lie. You don’t know what’s waiting for you on the other side.

Michael Swanwick, The Iron Dragon’s Daughter
This article is based on the post in the Krister Walfridsson’s blog, “Why undefined behavior may call a never called function?”.

The article draws a simple conclusion: undefined behavior in a compiler can do anything, even something absolutely unexpected. In this article, I examine the internal mechanism of this optimization works.
Read more →
Total votes 8: ↑7 and ↓1 +6
Comments 0

Just take a look at SObjectizer if you want to use Actors or CSP in your C++ project

Reading time 21 min
Views 3.3K


A few words about SObjectizer and its history


SObjectizer is a rather small C++ framework that simplifies the development of multithreaded applications. SObjectizer allows a developer to use approaches from Actor, Publish-Subscribe and Communicating Sequential Processes (CSP) models. It's an OpenSource project that is distributed under BSD-3-CLAUSE license.


SObjectizer has a long history. SObjectizer itself was born in 2002 as SObjectizer-4 project. But it was based on ideas from previous SCADA Objectizer that was developed between 1995 and 2000. SObjectizer-4 was open-sourced in 2006, but its evolution was stopped soon after that. A new version of SObjectizer with the name SObjectizer-5 was started in 2010 and was open-sourced in 2013. The evolution of SObjectizer-5 is still in progress and SObjectizer-5 has incorporated many new features since 2013.


SObjectizer is more or less known in the Russian segment of the Internet, but almost unknown outside of the exUSSR. It's because the SObjectizer was mainly used for local projects in exUSSR-countries and many articles, presentations, and talks about SObjectizer are in Russian.


A niche for SObjectizer and similar tools


Multithreading is used in Parallel computing as well as in Concurrent computing. But there is a big difference between Parallel and Concurrent computing. And, as a consequence, there are tools targeted Parallel computing, and there are tools for Concurrent computing, and they are different.

Read more →
Total votes 13: ↑11 and ↓2 +9
Comments 1

Dynamically generating robots.txt for ASP.NET Core sites based on environment

Reading time 3 min
Views 1.8K

I'm putting part of older WebForms portions of my site that still run on bare metal to ASP.NET Core and Azure App Services, and while I'm doing that I realized that I want to make sure my staging sites don't get indexed by Google/Bing.


I already have a robots.txt, but I want one that's specific to production and others that are specific to development or staging. I thought about a number of ways to solve this. I could have a static robots.txt and another robots-staging.txt and conditionally copy one over the other during my Azure DevOps CI/CD pipeline.


Then I realized the simplest possible thing would be to just make robots.txt be dynamic. I thought about writing custom middleware but that sounded like a hassle and more code that needed. I wanted to see just how simple this could be.


Read more →
Total votes 9: ↑8 and ↓1 +7
Comments 0

Authors' contribution