That's inspired. I guess the insight it that valgrind is basically retrofitting a type system over the raw memory accesses. I wonder if a similar approach cou

That's inspired. I guess the insight it that valgrind is basically retrofitting a type system over the raw memory accesses. I wonder if a similar approach could be used to check that certain classes of program input are all processed in a certain way? (e.g. untrusted data being escaped before display in an web app (XSS prevention), e.g. charset conversions being performed)? It would require more work (valgrind would need a different set of things to warn on, and a way of realising when some memory has been made safe). All very reminiscent of perl's taint mode (scalar values are flagged with a contagious 'taint bit', which prevents their use in output, calls to 'system()' etc.)