Mid ka mid ah xaaladaha ugu badan ee hadda jira ee isticmaalka PVS-Studio analyzer waa ku biirinteeda nidaamyada CI. In kasta oo falanqaynta mashruuca PVS-Studio ee ku dhawaad nidaam kasta oo is-dhexgalka joogtada ah lagu dhisi karo dhowr amarro, waxaan sii wadeynaa inaan ka dhigno habkan xitaa mid ku habboon. PVS-Studio hadda waxay haysataa taageero loogu beddelo wax soo saarka falanqaynta qaab TeamCity - TeamCity Inspections Type. Aan aragno sida ay u shaqeyso.
Macluumaadka ku saabsan software-ka la isticmaalay
- Falanqeeye joogto ah oo ah C, C++, C # iyo Java code, oo loogu talagalay in lagu fududeeyo hawsha raadinta iyo hagaajinta noocyada kala duwan ee khaladaadka. Falanqeeyaha waxaa loo isticmaali karaa Windows, Linux iyo macOS. Maqaalkani waxa aanu si firfircoon u isticmaali doonaa ma aha oo kaliya falanqaynta laftiisa, laakiin sidoo kale qaar ka mid ah utility ka qayb qaybinta.
- waa adeegaha kormeerka ee kormeera soo-bixitaanka isku-darka. Waa in isla markiiba la socodsiiyaa ka hor inta aan la bilaabin dhismaha mashruucaaga. Habka snooping, server-ku waxa uu dhexgalin doonaa socodsiinta dhammaan isku-dubaridayaasha la taageeray. Waxaa xusid mudan in utility-gan loo isticmaali karo oo kaliya in lagu falanqeeyo mashaariicda C/C++.
– utility loogu beddelo warbixinnada falanqeeyayaasha qaabab kala duwan.
Macluumaad ku saabsan mashruuca la baranayo
Aynu isku dayno shaqadan tusaale wax ku ool ah - aynu falanqeyno mashruuca OpenRCT2.
- Hirgelinta furan ee ciyaarta RollerCoaster Tycoon 2 (RCT2), oo lagu ballaarinayo hawlo cusub iyo hagaajinta cayayaanka. Ciyaartu waxay ku wareegaysaa dhisidda iyo dayactirka beerta madadaalada oo ka kooban raacyo, dukaamo, iyo tas-hiilaadyo. Ciyaaryahanku waa inuu isku dayo inuu faa'iido sameeyo oo uu ilaaliyo sumcadda beerta isagoo marti ku ah farxad. OpenRCT2 waxay kuu ogolaanaysaa inaad ku ciyaarto labada dhacdo iyo sanduuqa ciid. Muuqaaladu waxay u baahan yihiin ciyaartoygu inuu ku dhamaystiro hawl gaar ah waqti go'an gudaheed, halka Sandbox u ogolaado ciyaartoyga inuu dhiso jardiin badan oo dabacsan iyada oo aan wax xayiraad ah ama dhaqaale ah lahayn.
sixitaanka
Si aan wakhtiga u badbaadiyo, waxaan u badan tahay in aan ka boodo habka rakibaadda oo aan bilaabo wakhtiga aan haysto server-ka TeamCity ee ku shaqeeya kombayutarkayga. Waxaan u baahanahay inaan tagno: localhost: {dekedda cayiman inta lagu jiro habka rakibida} (xaaladkayga, localhost:9090) oo aan galno xogta oggolaanshaha. Kadib marka aan galno waxaa nala salaamaya:
Guji badhanka Abuur Mashruuca. Marka xigta, dooro Manually oo buuxi meelaha.
Kadib markaad riixdo badhanka Abuur, waxaa nalagu soo dhaweeyay daaqad leh goobaha.
Aynu gujino Samee qaabeynta dhismaha.
Buuxi meelaha oo guji Abuur. Waxaan aragnaa daaqad ku weydiinaysa inaad doorato nidaamka xakamaynta nooca. Maadaama ilaha ay horeba ugu yaalay gudaha, dhagsii Skip.
Ugu dambeyntii, waxaan u gudubnaa goobaha mashruuca.
Aynu ku darno talaabooyinka isu-ururinta, si aad tan u samayso guji: Dhis tallaabooyinka -> Ku dar tallaabo dhis.
Halkan waxaan ku dooraneynaa:
- Nooca Orodyahanka -> Line Command
- Orod -> Qoraalka gaarka ah
Maadaama aan samayn doono falanqayn inta lagu jiro ururinta mashruuca, isu-ururinta iyo falanqaynta waa hal tallaabo, markaa buuxi goobta Qoraalka Custom:
Waxaan eegi doonaa tillaabooyin shaqsi mar dambe. Waxaa muhiim ah in rarista falanqeeyayaasha, ururinta mashruuca, falanqaynta, soo saarida warbixinta iyo qaabaynta ay qaadato kaliya kow iyo toban sadar oo kood ah.
Waxa ugu dambeeya ee aan u baahanahay in aan sameyno waa in aan dejino doorsoomayaasha deegaanka, kuwaas oo aan qeexay siyaabaha qaar lagu hagaajin karo akhriskooda. Si tan loo sameeyo, aan sii wadno: Parameters -> Ku dar cabbir cusub kuna dar saddex doorsoome:
Waxa kaliya ee ay tahay inaad sameyso waa inaad riixdo badhanka Run geeska sare ee midig. Inta mashruuca la ururinayo oo la falanqeynayo, waxaan kuu sheegi doonaa qoraalka.
Qoraal toos ah
Marka hore, waxaan u baahanahay inaan soo dejino qaybinta PVS-Studio ee ugu dambeysay. Tan waxaan u isticmaalnaa maamulaha xirmada Chocolatey. Kuwa doonaya inay wax badan ka ogaadaan arrintan, waxaa jira mid u dhiganta :
choco install pvs-studio -yMarka xigta, aan bilowno utility dhiska mashruuca CLMonitor.
%CLmon% monitor –-attachKadibna waxaan u dhisi doonaa mashruuca sida doorsoomayaasha deegaanka MSB waa wadada loo maro nooca MSBuild aan u baahanahay inaan dhiso
%MSB% %ProjPath% /t:clean
%MSB% %ProjPath% /t:rebuild /p:configuration=release
%MSB% %ProjPath% /t:g2
%MSB% %ProjPath% /t:PublishPortableAan galino galitaanka iyo furaha shatiga ee PVS-Studio:
%PVS-Studio_cmd% credentials --username %PVS_Name% --serialNumber %PVS_Key%Ka dib markii dhismuhu dhammeeyo, socodsii CLMonitor mar kale si aad u abuurto faylal horay loo habeeyay iyo falanqaynta taagan:
%CLmon% analyze -l "c:ptest.plog"Markaa waxaan isticmaali doonaa adeeg kale oo qaybintayada ah. PlogConverter waxay ka beddeshaa warbixinta qaab caadi ah una beddeshaa qaab TeamCity-gaar ah. Waad ku mahadsan tahay tan, waxaan awood u yeelan doonaa inaan si toos ah ugu aragno daaqada dhismaha.
%PlogConverter% "c:ptest.plog" --renderTypes=TeamCity -o "C:temp"Tallaabada ugu dambeysa waa in lagu soo bandhigo warbixinta la qaabeeyey dhejis, halkaas oo ay ka qaadi doonaan baarser-ka TeamCity.
type "C:tempptest.plog_TeamCity.txt"Koodhka qoraalka buuxa:
choco install pvs-studio -y
%CLmon% monitor --attach
set platform=x64
%MSB% %ProjPath% /t:clean
%MSB% %ProjPath% /t:rebuild /p:configuration=release
%MSB% %ProjPath% /t:g2
%MSB% %ProjPath% /t:PublishPortable
%PVS-Studio_cmd% credentials --username %PVS_Name% --serialNumber %PVS_Key%
%CLmon% analyze -l "c:ptest.plog"
%PlogConverter% "c:ptest.plog" --renderTypes=TeamCity -o "C:temp"
type "C:tempptest.plog_TeamCity.txt"Dhanka kale, isku dhafka iyo falanqaynta mashruuca ayaa si guul leh loo dhameeyay, waxaan aadi karnaa tab Mashaariicda iyo UBEDITUSYA в эtom.
Hadda aan gujino Wadarta guud ee kormeerkasi aad u daawato warbixinta falanqaynta:
Digniinaha waxaa lagu kooxeeyay lambarrada sharciga ogaanshaha. Si aad u dhex marato koodka, waxaad u baahan tahay inaad gujiso lambarka khadka digniinta leh. Gujista calaamadda su'aasha ee ku taal geeska sare ee midig waxay kuu furaysaa tab cusub oo ay ku jiraan dukumeenti. Waxaad sidoo kale dhex mari kartaa koodka adigoo gujinaya lambarka khadka oo leh digniinta falanqeeye. Ka soo wareegidda kumbuyuutarka fog waa suurtagal marka la isticmaalayo SourceTreeRoot calaamadeeye. Qof kasta oo danaynaya habkan hawlgalka falanqeeyuhu wuxuu la qabsan karaa qaybta u dhiganta .
Daawashada natiijooyinka falanqaynta
Hadda oo aanu dhamaynay hawlgelinta iyo habaynta dhismaha, aynu eegno digniino xiiso leh oo laga helay mashruuca aanu eegayno.
Digniin N1
[CWE-401] Marka laga reebo waa la tuuray iyada oo aan la sii dayn tilmaamayaasha 'natiijada'. Diiditaanka xusuusta ayaa suurtagal ah. libopenrct2 ObjectFactory.cpp 443
Object* CreateObjectFromJson(....)
{
Object* result = nullptr;
....
result = CreateObject(entry);
....
if (readContext.WasError())
{
throw std::runtime_error("Object has errors");
}
....
}
Object* CreateObject(const rct_object_entry& entry)
{
Object* result;
switch (entry.GetType())
{
case OBJECT_TYPE_RIDE:
result = new RideObject(entry);
break;
case OBJECT_TYPE_SMALL_SCENERY:
result = new SmallSceneryObject(entry);
break;
case OBJECT_TYPE_LARGE_SCENERY:
result = new LargeSceneryObject(entry);
break;
....
default:
throw std::runtime_error("Invalid object type");
}
return result;
}Falanqeeyuhu wuxuu ogaaday khalad ka dib markii si firfircooni ah loogu qoondeeyay xusuusta Abuur Shay, marka ay ka reeban tahay, xusuusta lama nadiifiyo, oo dib u dhac xusuusta ayaa dhacda.
Digniin N2
Waxa jira tibaaxo-hoosaadyo isku mid ah '(1ULL << WIDX_MONTH_BOX)' ee bidix iyo midig ee '|' hawlwadeen. libopenrct2ui Cheats.cpp 487
static uint64_t window_cheats_page_enabled_widgets[] =
{
MAIN_CHEAT_ENABLED_WIDGETS |
(1ULL << WIDX_NO_MONEY) |
(1ULL << WIDX_ADD_SET_MONEY_GROUP) |
(1ULL << WIDX_MONEY_SPINNER) |
(1ULL << WIDX_MONEY_SPINNER_INCREMENT) |
(1ULL << WIDX_MONEY_SPINNER_DECREMENT) |
(1ULL << WIDX_ADD_MONEY) |
(1ULL << WIDX_SET_MONEY) |
(1ULL << WIDX_CLEAR_LOAN) |
(1ULL << WIDX_DATE_SET) |
(1ULL << WIDX_MONTH_BOX) | // <=
(1ULL << WIDX_MONTH_UP) |
(1ULL << WIDX_MONTH_DOWN) |
(1ULL << WIDX_YEAR_BOX) |
(1ULL << WIDX_YEAR_UP) |
(1ULL << WIDX_YEAR_DOWN) |
(1ULL << WIDX_DAY_BOX) |
(1ULL << WIDX_DAY_UP) |
(1ULL << WIDX_DAY_DOWN) |
(1ULL << WIDX_MONTH_BOX) | // <=
(1ULL << WIDX_DATE_GROUP) |
(1ULL << WIDX_DATE_RESET),
....
};Dad yar oo aan ahayn falanqeeye taagan ayaa ku gudbi kara imtixaankan feejignaanta. Tusaalahan koobi-koobida ah ayaa u wanaagsan sababtan saxda ah.
Digniin N3
Waa wax la yaab leh in goobta 'calanka' ee fasalka la soo saaray 'RCT12BannerElement' ay ku dul qorto goobta fasalka 'RCT12TileElementBase'. Eeg khadadka: RCT12.h:570, RCT12.h:259. libopenrct2 RCT12.h 570
struct RCT12SpriteBase
{
....
uint8_t flags;
....
};
struct rct1_peep : RCT12SpriteBase
{
....
uint8_t flags;
....
};Dabcan, adeegsiga doorsoome leh magac isku mid ah fasalka aasaasiga ah iyo faraca mar walba khalad ma aha. Si kastaba ha ahaatee, tignoolajiyada dhaxalka lafteedu waxay u malaynaysaa in dhammaan qaybaha fasalka waalidku ay ku jiraan fasalka ilmaha. Markaynu ku dhawaaqno meelo magac isku mid ah ku leh dhaxalka, waxaynu abuurnaa jahawareer.
Digniin N4
Waa wax la yaab leh in natiijada 'imageDirection / 8' ay tahay qayb ka mid ah xaaladda. Malaha, waxay ahayd in hadalkan wax kale lala barbar dhigo. libopenrct2 ObservationTower.cpp 38
void vehicle_visual_observation_tower(...., int32_t imageDirection, ....)
{
if ((imageDirection / 8) && (imageDirection / 8) != 3)
{
....
}
....
}Aan si hoose u eegno. Odhaahda imageHagaag/8 been noqon doontaa haddii imageDirection waxay u dhaxaysaa -7 ilaa 7. Qaybta labaad: (imageDirection / 8) != 3 jeegaga imageDirection Ka baxsan xadka: laga bilaabo -31 ilaa -24 iyo 24 ilaa 31, siday u kala horreeyaan. Waxay ila tahay arrin la yaab leh in aan sidaas u hubiyo lambarrada ku darida qayb gaar ah oo sidan oo kale ah, xitaa haddii aysan wax qalad ah ka jirin gabalkan koodka, waxaan ku talin lahaa in dib loo qoro shuruudahan si ay u noqoto mid cad. Tani waxay nolosha u fududaynaysaa dadka akhrin lahaa oo ilaalin lahaa xeerkan.
Digniin N5
Isku xigxig aan fiicneyn oo ah shaqooyinka noocaan ah: A = B; B = A;. Hubi khadadka: 1115, 1118. libopenrct2ui MouseInput.cpp 1118
void process_mouse_over(....)
{
....
switch (window->widgets[widgetId].type)
{
case WWT_VIEWPORT:
ebx = 0;
edi = cursorId; // <=
// Window event WE_UNKNOWN_0E was called here,
// but no windows actually implemented a handler and
// it's not known what it was for
cursorId = edi; // <=
if ((ebx & 0xFF) != 0)
{
set_cursor(cursorId);
return;
}
break;
....
}
....
}Koodhkan jajabka ah waxay u badan tahay in lagu helay kala furfurid. Kadib, adoo ku xukumaya faallooyinka bidix, qayb ka mid ah koodhka aan shaqaynayn ayaa meesha laga saaray. Si kastaba ha ahaatee, waxaa weli haray dhowr qalliin cursorId, taas oo sidoo kale aan macno badan samayn.
Digniin N6
[CWE-476] Tilmaamaha 'ciyaaryahan' waxaa loo adeegsaday si aan badbaado lahayn ka dib markii laga xaqiijiyay nullptr. Hubi khadadka: 2085, 2094. libopenrct2 Network.cpp 2094
void Network::ProcessPlayerList()
{
....
auto* player = GetPlayerByID(pendingPlayer.Id);
if (player == nullptr)
{
// Add new player.
player = AddPlayer("", "");
if (player) // <=
{
*player = pendingPlayer;
if (player->Flags & NETWORK_PLAYER_FLAG_ISSERVER)
{
_serverConnection->Player = player;
}
}
newPlayers.push_back(player->Id); // <=
}
....
}Koodhkani aad buu u fudud yahay in la saxo; waxaad u baahan tahay oo keliya inaad mar saddexaad hubiso ciyaaryahan tilmaame aan waxba ka jirin, ama ku dar jidhka bayaanka shuruudda ah. Waxaan soo jeedin lahaa doorashada labaad:
void Network::ProcessPlayerList()
{
....
auto* player = GetPlayerByID(pendingPlayer.Id);
if (player == nullptr)
{
// Add new player.
player = AddPlayer("", "");
if (player)
{
*player = pendingPlayer;
if (player->Flags & NETWORK_PLAYER_FLAG_ISSERVER)
{
_serverConnection->Player = player;
}
newPlayers.push_back(player->Id);
}
}
....
}Digniin N7
[CWE-570] Odhaahda 'magaca == nullptr' had iyo jeer waa been. libopenrct2 ServerList.cpp 102
std::optional<ServerListEntry> ServerListEntry::FromJson(...)
{
auto name = json_object_get(server, "name");
.....
if (name == nullptr || version == nullptr)
{
....
}
else
{
....
entry.name = (name == nullptr ? "" : json_string_value(name));
....
}
....
}Waxaad hal mar ka takhalusi kartaa khadadka koodka akhriska adag oo aad ku xalliso dhibaatada adigoo hubinaya nullptr. Waxaan soo jeedinayaa in koodka loo beddelo sida soo socota:
std::optional<ServerListEntry> ServerListEntry::FromJson(...)
{
auto name = json_object_get(server, "name");
.....
if (name == nullptr || version == nullptr)
{
name = ""
....
}
else
{
....
entry.name = json_string_value(name);
....
}
....
}Digniin N8
[CWE-1164] Doorsoomiyaha 'ColumnHeaderPressedCurrentState' waxa loo qoondeeyay isla qiime. libopenrct2ui CustomListView.cpp 510
void CustomListView::MouseUp(....)
{
....
if (!ColumnHeaderPressedCurrentState)
{
ColumnHeaderPressed = std::nullopt;
ColumnHeaderPressedCurrentState = false;
Invalidate();
}
}Koodhku wuxuu u muuqdaa mid qariib ah. Waxay iila muuqataa in ay jirtay typo ama xaalad ahaan ama marka dib-u-dejinta doorsoomayaasha ColumnHeaderPressedCurrentState qiimayaasha been ah.
gunaanad
Sida aan arki karno, ku-daridda PVS-Studio static analyzer ee mashruucaaga TeamCity waa wax fudud. Si tan loo sameeyo, waa ku filan inaad qorto hal fayl qaabeyn yar oo keliya. Hubinta koodhka ayaa kuu ogolaanaya inaad ogaato dhibaatooyinka isla markiiba ka dib marka la isku yimaado, taas oo kaa caawin doonta in la tirtiro marka kakanaanta iyo kharashka isbeddelku weli hooseeyo.
Haddii aad rabto inaad maqaalkan la wadaagto dhagaystayaasha ku hadla Ingiriisiga, fadlan isticmaal xidhiidhka tarjumaadda: Vladislav Stolyarov. .
Source: www.habr.com