Post by Howard Chu @ Symas

Takahē

Machine generated #OpenLDAP bug reports - How it started / How it's going

Edited 9d ago

1 0 0 View Post & Replies See Original

The quality of analysis displayed here was even worse than Coverity or Veracode. They see "it's possible for this function to return NULL, but the caller didn't check! Ooo, vulnerability!" but in fact due to preceding logic, the function will never get called with an input that would yield a NULL result.

"Data flow analysis", have you heard of it?

All these LLM folks think they can just brute force pattern match everything and discard decades of knowledge from compiler design, etc. etc...

Edited 9d ago

0 0 0 View Post & Replies See Original