Comment by imglorp | Hacker News Reader

Top New Best Ask Show Jobs

Comment by imglorp | Hacker News Reader

Another OOB? At this point, hasn't anyone run a static analyzer on the darn thing and fixed all the warnings?

11/16 - NPR - https://mta.openssl.org/pipermail/openssl-announce/2016-Nove...

9/16 - dangling pointer - https://mta.openssl.org/pipermail/openssl-announce/2016-Sept...

5/16 - buffer underflow - https://mta.openssl.org/pipermail/openssl-announce/2016-May/...

3/16 - NPE, double free, etc - https://mta.openssl.org/pipermail/openssl-announce/2016-Marc...

... I'm tired looking...

The OpenBSD team runs coverity on their LibreSSL fork and continues to improve the codebase constantly. More distributions are switching to LibreSSL too.

Every time I've looked at the code, it's been … idiosyncratic to the point where I would imagine that “fixing all of the warnings” would be a significant exercise.

If static analyzers could find all problems in C with a low false positive rate, then that'd eliminate one of the big problems with C and partially negate the need for Rust.

I've run several respected static analyzers against several well respected projects and I'm lucky if I get more than 2-3 false positives.

In the Argon2 reference library, the one alert from Infer was a genuine bug I sent a PR for, followed by one alert from tis-interpreter that was another genuine bug. clang-analyser produces clean output.

It's true that you get so many false positives under OpenSSL it's not feasible to review. I would contend this is an indicator of code quality more than an indicator of poor static analysers.

Reply on news.ycombinator.com