3 ms·

> As a compiler writer, the burden of proof that this is a bug isn't on me, its on you. Normally true, but not for SQLite. SQLite is probably the most thorough

> As a compiler writer, the burden of proof that this is a bug isn't on me, its on you. Normally true, but not for SQLite. SQLite is probably the most thoroughly tested and correctness conscious piece of software anywhere in open source. I think with SQLite, the burden is on the compiler writer.

the_why_of_y 6y ago
Nevertheless OSSFuzz found legitimate UB bugs in SQLite before. https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=Proj%3Dsqlite3+Type%3DBug-Security+status%3ANew%2CAccepted%2CFixed%2CVerified&colspec=ID+Type+Component+Status+Proj+Reported+Owner+Summary&cells=ids https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=Pro...
fluffything 6y ago
> SQLite is probably the most thoroughly tested and correctness conscious piece of software anywhere in open source. Given the amounts of bugs that are both filled and fixed on a daily basis, reality does not seem to reflect this claim. If you expect compiler writers to go and explore your open source project of choice in a blind hunt for compiler bugs that they can fix, I hope you sit down while you wait and do not really need these kinds of bugs actually fixed.