News for hackers. Stuff that matters.

A comment on Why CVE-2022-3602 was not detected by fuzz testing. Parent comment

Re:Why CVE-2022-3602 was not detected by fuzz testing by planede on Monday November 21, 2022 @12:21PM (#33695152)
Mistakes in proofs are just as probable as mistakes in exhaustive tests.

An exhaustive test is just one type of a machine verified proof.

[ Parent | on HN ]
Re:Why CVE-2022-3602 was not detected by fuzz testing by nicoburns on Monday November 21, 2022 @01:48PM (#33696289)
> An exhaustive test is just one type of a machine verified proof.

Not entirely sure I agree with this. A proof by construction is a very different beast to empirical unit tests that only cover a subset of inputs. The equivalent would be units tests that cover every single possible input.

[ Parent | on HN ]
Re:Why CVE-2022-3602 was not detected by fuzz testing by planede on Tuesday November 22, 2022 @03:57AM (#33703600)
> The equivalent would be units tests that cover every single possible input.

That's what "exhaustive" means.

[ Parent | on HN ]