News for hackers. Stuff that matters.
Re:Remote code execution vulnerability in SQLite by gregmac on Friday December 14, 2018 @06:24PM (#18685857)
Consider a line like:

    value = 1 / input;
You can get "100% coverage" if you test that with `input = 1`, but unless you check with `input = 0` you're missing a quite important logical check.
Re:Remote code execution vulnerability in SQLite by breckuh on Friday December 14, 2018 @08:47PM (#18686517)
Can't you just have a NonZeroInt type?
Re:Remote code execution vulnerability in SQLite by whyonearth on Friday December 14, 2018 @08:58PM (#18686553)
Only if your language supports dependent types.
Re:Remote code execution vulnerability in SQLite by tonyg on Saturday December 15, 2018 @10:47AM (#18688778)
It's perfectly possible in languages with ordinary ADTs.

  data Nat = Z | S Nat
  data NonZeroNat = OnePlus Nat
  data NonZeroInt = Negative NonZeroNat | Positive NonZeroNat
Re:Remote code execution vulnerability in SQLite by jwatte on Sunday December 16, 2018 @12:46PM (#18694109)
C isn't one of those languages, though.
Re:Remote code execution vulnerability in SQLite by tonyg on Monday December 17, 2018 @03:47PM (#18702049)
The analogous would be the Go-style represent-a-sum-badly-as-a-product,

  struct nonzero_t {
    int is_negative;
    unsigned int one_less_than_the_absolute_value;
  };
which, under interpretation, ranges from -(2^32) to -1 and +1 to +(2^32).
Re:Remote code execution vulnerability in SQLite by krylon on Saturday December 15, 2018 @08:25AM (#18688292)
In Ada, you can define integer types that only accept a given range of values.
Re:Remote code execution vulnerability in SQLite by akvadrako on Friday December 14, 2018 @06:52PM (#18685997)
Not really - internally inputs 0 and 1 use different branches.
Re:Remote code execution vulnerability in SQLite by RussianCow on Friday December 14, 2018 @06:59PM (#18686028)
That's not a branch; otherwise you would have an infinite (or impossibly large) number of branches for just that one line of code. A branch is when you execute one set of code upon a given condition, and another if that condition is not met.
Re:Remote code execution vulnerability in SQLite by akvadrako on Friday December 14, 2018 @08:04PM (#18686340)
I didn't say every number is a different branch. But on many processors, divide by zero triggers an interrupt. That's semantically the same as a branch.
Re:Remote code execution vulnerability in SQLite by qznc on Friday December 14, 2018 @07:26PM (#18686164)
It depends on the language. In C it is not a branch because division by zero is undefined and not a path you consider. In Java you can argue that there are two branches. One branch that throws an exception and one that does not.
Re:Remote code execution vulnerability in SQLite by zaphar on Friday December 14, 2018 @08:03PM (#18686335)
No coverage reporting library will attempt to tell you that kind of coverage. You are essentially in violent agreement with the op but turning it into an argument by using different words for the same concept.