Heap-based buffer overflow in Sudo

Re:Heap-based buffer overflow in Sudo by iovrthoughtthis on Wednesday January 27, 2021 @02:55AM (#25925482)

> And of course, it's perfectly reasonable to form beliefs about code from reading it.

Broadly yes, but it would be hubris to claim you can tell the correctness of all code from merely looking at it.

[ Parent | on HN ]

Re:Heap-based buffer overflow in Sudo by cheph on Wednesday January 27, 2021 @03:28AM (#25925672)

For some code you should be able to do this, and if you can't then I don't think you should be writing code.

Coding is not brute forcing. I feel like this is taking an extreme position at the complete opposite end from not testing anything.

EDIT: Misread the comment I replied to. I agree that it is not likely that anyone can tell the correctness of all code from merely looking at it.

[ Parent | on HN ]

Re:Heap-based buffer overflow in Sudo by kaba0 on Wednesday January 27, 2021 @04:52AM (#25926220)

For some code, yes. What about a complete refactor of the core functionality of said program, with parallelism and the like?

[ Parent | on HN ]

Re:Heap-based buffer overflow in Sudo by cheph on Wednesday January 27, 2021 @05:01AM (#25926290)

I misread the comment I think, but either way, I am not arguing against automated tests, I was just trying to point out that for some fragments of a code base you should absolutely be able to tell correctness by looking at it.

[ Parent | on HN ]