Even safety critical software can run reliably for the range of inputs that it's likely to ever see, but contain security holes. For something like OpenSSL, it

Even safety critical software can run reliably for the range of inputs that it's likely to ever see, but contain security holes. For something like OpenSSL, it must produce a correct output for every single possible input. Even safety critical software may extremely rarely fail in unusual conditions. For security sensitive software though, all it takes is a single possible input that will trigger a bug, because the attacker is not a random process. Writing secure software in C is extremely difficult.