3 ms·
Sanitizers only help find bugs that are actually triggered. Security vulnerabilties usually come from code paths that are not commonly exercised.
by heinrich5991 12y ago
Sanitizers only help find bugs that are actually triggered. Security vulnerabilties usually come from code paths that are not commonly exercised.
- makomk 12y agoI'm not sure that's actually true in the case of ThreadSanitizer - a well-designed data race detector can detect race conditions that didn't actually get triggered in that run. In any case, usually people try and exercise those rare code paths by running a fuzzer against sanitizer-instrumented code.
- heinrich5991 12y agoThreadSanitizer can also only catch bugs that can occur in the code paths that are exercised – and running a fuzzer can certainly show the presence of bugs, but I'd be wary if someone claimed it can show the absence of them.