看板FB_security
標 題Re: OpenSSL static analysis, was: De Raadt + FBSD + OpenSSH + hole?
發信站NCTU CS FreeBSD Server (Thu Apr 24 06:21:04 2014)
轉信站ptt!csnews.cs.nctu!news.cednctu!FreeBSD.cs.nctu!.POSTED!freebsd.org!ow
Den 23/04/2014 kl. 21.14 skrev Charles Swiger <
[email protected]>:
> The most straightforward changes to this snippet would be either:
>
> int foo(int y, int z) {
> int x;
> if (y == z) {
> x = 0;
> } else {
> x = 1;
> }
> return x;
> }
>
> ...or:
>
> int foo(int y, int z) {
> int x = 0;
> if (y != z) {
> x = 1;
> }
> return x;
> }
>
> Not only are both of these shorter and they pass clang's static analyzer without a warning, I'd argue that the second version is noticeably cleaner.
I don't disagree with you, but rewriting 1000 if-else cases in single-threaded userland programs just so the analyzer understands them is 1) tedious and 2) bound to accidentally introduce at least 50 new bugs, since most real-life examples are considerably more complicated than the minimal example I posted.
Erik
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "
[email protected]"