3 ms·

How does fuzzing fit into static analysis? By my understanding, Static Analysis is defined as examining the code without executing it and fuzzing would inheren

• thesz 10y ago
  Executing code with single input value is a subset of (symbolic) execution of the same code with all values. You cannot "examine the code" without executing it, partially or in full, with some input or intermediate values or (symbolically) with all of them. I am sure I sound contrary to "common definitions" - so be it. I also think that dynamic typing is a subset of static typing, more or less for the same reason.
  • emeraldd 10y ago
    > You cannot "examine the code" without executing it, partially or in full, with some input or intermediate values or (symbolically) with all of them. It is entirely possible to break a stream of text down into symbols and examine the relationship of those symbols without evaluating (i.e. executing) them. It is not really necessary or possible to know their meaning/definition at all, only their "shape" or the "part of speech" that they represent. In the simplest form, static analyzers are a set of heuristic pattern matchers that a stream of text is sent through. It might get fancy and build an AST first, but that still does not constitute execution or evaluation in the technical sense.