Stranger Strings: An exploitable flaw in SQLite

Re:Stranger Strings: An exploitable flaw in SQLite by pclmulqdq on Tuesday October 25, 2022 @01:13PM (#33333394)

Formal verification also becomes practically impossible at a certain level of complexity.

SQLite is better tested than many silicon chips, so it's hard to fault their testing strategy.

Perhaps a few static analyzers should be run on the codebase to find possible bugs like this.

[ Parent | on HN ]

Re:Stranger Strings: An exploitable flaw in SQLite by hulitu on Tuesday October 25, 2022 @04:04PM (#33335454)

> Formal verification also becomes practically impossible at a certain level of complexity.

Then reduce complexity.

[ Parent | on HN ]

Re:Stranger Strings: An exploitable flaw in SQLite by function_seven on Tuesday October 25, 2022 @04:34PM (#33335777)

You can make things as simple as possible, but no simpler than that.

SQLite is a complex program, inherently. It's designed to allow users to do complex things, and as such cannot be simpler than its purpose allows.

I'm no formal verification expert—so I don't know if SQLite is above or below that fuzzy threshold—but "reduce complexity" is not always an available tool.

[ Parent | on HN ]

Re:Stranger Strings: An exploitable flaw in SQLite by nottorp on Tuesday October 25, 2022 @04:21PM (#33335627)

Well, int main (void) { return 1; } is most likely bug free. But it's not useful (except as /bin/true).

[ Parent | on HN ]

Re:Stranger Strings: An exploitable flaw in SQLite by jwilk on Tuesday October 25, 2022 @06:04PM (#33336743)

That would be a very buggy /bin/true implementation.

[ Parent | on HN ]

Re:Stranger Strings: An exploitable flaw in SQLite by nottorp on Wednesday October 26, 2022 @05:09AM (#33341350)

Right, but a correct /bin/false :)

[ Parent | on HN ]