Hacker News Reader

musl: https://www.cvedetails.com/vulnerability-list/vendor_id-1685...

Can't find separate listings for libc in FreeBSD, OpenBSD but the list is smaller than glibc if you check e.g., VuXML or https://www.cvedetails.com/vulnerability-list/vendor_id-97/p...

Looks like glibc is the worst sinner here.

More people study and use glibc, so I guess they find more bugs. On the other hand glibc has a larger code base. Anyway it's difficult to compare bug counts across projects.

Half of them are logic errors and around 15 bugs are integer overflows of which the project above is riddled with.

No no, these are not bugs, you are just misinterpreting the {standard, API, intention, stars} ;-)

/sarcasm

Hm, at those who downvoted me: Read some older glibc bug reports.

For example the one about sscanf("foo", "%10s", strptr) returning 1. Hint: According to the standard, it should return 0. Musl does it right, which recently broke some of my test cases. But the bug is known and not fixed since years, maybe a decade...