3 ms·
I think they are not going far enough. "All null-pointer-referencing issues should come with an accompanying fix pull request".
by otikik 1y ago
I think they are not going far enough.
"All null-pointer-referencing issues should come with an accompanying fix pull request".
- tzs 1y agoSo if I find a null pointer dereference issue in something written in a language I don’t know, I shouldn’t report it because I can’t include a fix?
- otikik 1y agoIf you don't know the language, why are you reporting null pointers?
- tzs 1y agoBecause the program crashed and the crash dump showed a null pointer dereference, and I found some inputs that reproduce it 100%, so I thought this might be useful to the developer?
- otikik 1y agoIn the context of libxml it does sound that for every hypothetical person like you that there's going to be 20 "security researchers" like the ones the article is mentioning; just running automated tools and trying to use security issues as a way to promote themselves. If getting rid of your input gets rid of the other 20 issues, I would take it.
- jeroenhd 1y agoI don't think putting the burden to fix the code should be on users. However, it also shouldn't be on developers. I think something like "Null-pointer-referencing issues will not be looked at by core maintainers unless someone already provides a patch". That way, someone else who knows how to fix the problem can step in, and users aren't left with the false impression that merely reporting their bug will not guarantee a solution.
- pmlnr 1y agoNot users. Security researchers.