3 ms·
That's what I'm saying; a static analyser will be able to determine whether the code and/or state is reachable without any AI, and it will be completely determi
by userbinator 7mo ago
That's what I'm saying; a static analyser will be able to determine whether the code and/or state is reachable without any AI, and it will be completely deterministic in its output.
- array_key_first 7mo agoYou cannot tell if code is actually reachable if it depends on runtime input. Those really evil bugs are the ones that exist in code paths that only trigger 0.001% of the time. Often, the code path is not triggerable at all with regular input. But with malicious input, it is, so you can only find it through fuzzing or human analysis.
- userbinator 7mo agoYou cannot tell if code is actually reachable if it depends on runtime input. That is precisely what a static analyser can determine. E.g. if you are reading a 4-byte length from a file, and using that to allocate memory which involves adding that length to some other constant, it will assume (unless told otherwise) that the length can be all 4G values and complain about the range of values which will overflow.
- ascorbic 7mo agoWhy hasn't it then? The Linux kernel must be asking the most heavily-audited pieces of software in existence, and yet these bugs were still there.
- userbinator 7mo agoPeople find and report bugs in the kernel using static analysers all the time.