3 ms·
I wonder if any of the existing static code analyzers would have found this? PVS-Studio checks some open source projects and posts part of the results on their
by Flow 13y ago
I wonder if any of the existing static code analyzers would have found this?
PVS-Studio checks some open source projects and posts part of the results on their blog. I did a search and found that they did take a look at OpenSSL in 2012.
http://www.viva64.com/en/b/0183/ http://www.viva64.com/en/b/0183/
And Coverity: https://scan.coverity.com/projects/294 https://scan.coverity.com/projects/294
- Shish2k 12y agoI wonder how "unvalidated user input passed to memcpy()" didn't trigger all of the static analysers... I guess that the anaylser doesn't know that it's untrusted - perhaps it's worth having separate "trusted int" and "untrusted int" data types, so this would've been a compile-time error?
- Flow 12y agoOr create a standard of annotations for C, like those used by Java and C#? NotNull, CanBeNull etc, and let the static analyzers use those hints to help even more.