Our website uses cookies to enhance your browsing experience.
Accept
to the top
close form

Fill out the form in 2 simple steps below:

Your contact information:

Step 1
Congratulations! This is your promo code!

Desired license type:

Step 2
Team license
Enterprise license
** By clicking this button you agree to our Privacy Policy statement
close form
Request our prices
New License
License Renewal
--Select currency--
USD
EUR
* By clicking this button you agree to our Privacy Policy statement

close form
Free PVS‑Studio license for Microsoft MVP specialists
* By clicking this button you agree to our Privacy Policy statement

close form
To get the licence for your open-source project, please fill out this form
* By clicking this button you agree to our Privacy Policy statement

close form
I am interested to try it on the platforms:
* By clicking this button you agree to our Privacy Policy statement

close form
check circle
Message submitted.

Your message has been sent. We will email you at


If you haven't received our response, please do the following:
check your Spam/Junk folder and click the "Not Spam" button for our message.
This way, you won't miss messages from our team in the future.

>
>
Use PVS-Studio to Increase the Reliabil…

Use PVS-Studio to Increase the Reliability and Security of Financial Software

Sep 01 2017
Author:

Among our clients some organizations involved in developing software in the field of finance are gradually starting to appear. We have many articles on different topics, but we somehow unfairly spared the scope of finance. We shall try to mend and eventually write some articles, and I'll begin with a little story.

0528_Finances/image1.png

Introductory paragraph for those who are not familiar with PVS-Studio tool. PVS-Studio static code analyzer is designed to detect errors and potential vulnerabilities in code written in C#, C, C++ languages and dialects of the C++ language, such as C++/CLI and C++/CX (WinRT). It works in Windows and Linux environment. At the moment, PVS-Studio is one of the most powerful tools in the class of static analyzers and it can detect many types of defects. We suggest to get acquainted both with the list of warnings, and the examples of using the analyzer.

PVS-Studio allows to detect many errors right after they appeared. The faster an error is detected, the cheaper it is to correct it. For example, here's the way the cost of security defect grows according to NIST:

0528_Finances/image2.png

PVS-Studio analyzer is extremely in demand in those spheres where any error can lead to a great loss of time or money. One of such spheres of software development is the financial sector. For example, it is about trading and banking software. We see a gradual increase in interest from teams, serving financial companies and they began to add to the list of our clients of financial sector. However, we need to pay more attention to this area and this article is the first swallow.

Now I will tell you a promised story. The analyzer includes V3040 diagnostic that detects a situation when one integer value is divided by another integer value and the result is placed in a variable of float or double type. Of course, similar code is not always wrong, but it is definitely suspicious and requires code review.

Someone believes that a similar error is far-fetched and a warning V3040 will often be false. He might be right, and wrong. It all depends on the type of application and from what, in fact, the program evaluates.

One man said that the team, where he worked, has found a very nasty bug in their software using this diagnostic. I can not tell, where this person works, because the story was shared with me on the condition of anonymity (no, it was not a bank).

The module in which the bug was found, counted flexible prices for different options and conditions of orders. In other words, it counted what price a sales manages should say to a potential client. The error crept into the account of a certain rate. Integer division was used where it must not be used:

double K;
....
if (foo)
  K = 200 / 95;
else
....

I will tell at once that I thought of this code and I don't know how it was designed. The idea is that instead of the multiplier of 2.1, rate 2 has turned out. As a result, managers began dialogue with the client, making a price slightly lower than it supposed to be. Price was calculated wrong only when a certain combination of conditions, so no one ever noticed a mistake, relying on those numbers, which were issued by the program.

As I said, this coefficient was calculated wrong only in rare cases, this error did not harm the company's revenue. However, the error was so unpleasant for developers that they decided to hide its discovery from a senior manager and just quietly fixed the code.

Let us leave aside the question of rightness of these programmers' behavior. It is much more interesting that a very simple integer division error leads to consequences that are shameful to tell to superiors.

0528_Finances/image3.png

As you can see, even simple mistakes can cause loss of time, money, and reputation. If we are talking about more significant software, then errors can come at extremely high cost. Those who develop software for finance, use an integrated approach for reliability. Static PVS-Studio analyzer can become a great addition to the set of measures to control the quality of your code.

I suggest to all who care about the quality of the code, immediately download and try PVS-Studio. It will find your errors, and you'll be overwhelmed by that luck why the program actually worked :). It's better to detect many errors using analyzer, but not with the help of your clients, and certainly not by hackers.

In addition, reports of PVS-Studio can be very nice to show for superiors, having integrated them with the SonarQube tool.

0528_Finances/image4.png

A few introductory videos on PVS-Studio (in English):

Popular related articles


Comments (0)

Next comments next comments
close comment form