Frama-C In a previous post we remarked that the decompression function of zlib for some inputs computes an invalid pointer. But at least it neither dereferences it nor compares it to another pointer. Or does it? Recipe for an invalid pointer comparison Instrument Take an ordinary zlib library version 1.2.7 and...
Read MoreAs an interlude in the zlib verification thread, this post asks two questions. Is there any chance of finding a bug in zlib, and does it matter? Could there be a bug in zlib? It is not entirely impossible. The previous post in this blog pointed to a relatively minor...
Read MoreIn an article about comparing static analyzers (long-time readers of the blog do not follow the link. It is still the same old article)… Where was I? Ah yes. One reason why it is extremely tricky to compare static analyzers is that a static analyzer is for identifying undefined behavior...
Read MoreA couple of months ago, I packed a computer into a brown plastic bag of the kind usually used for trash. I then carried the carefully packed computer down to the basement. Physically, the computer still works. It is still beautiful (it is an iMac G4). It has been with...
Read MoreRobert Graham, of the blog Errata Security, predicts that “vulnerabilities in Acrobat Reader Adobe Flash and Java today […] will be announced and patched in 2013”. As fate would have it he could safely have included Internet Explorer 8 in his list of software products used by millions to process...
Read More