> oh wait, Coverty couldn't catch Heartbleed, oops Not fair. Iirc the reason Coverity couldn't catch Heartbleed was because the OpenSSL people insisted on roll

> oh wait, Coverty couldn't catch Heartbleed, oops Not fair. Iirc the reason Coverity couldn't catch Heartbleed was because the OpenSSL people insisted on rolling their own inferior memory allocation. It would have worked if they just used the system malloc(). Coverity only works for normal programmers, it can't fully mitigate the ingenuity of complete fools. Of course, my recollection could be wrong. In which case "someone is wrong on the Internet" will apply and someone will quickly set the record straight.