Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 18-Feb-2025 08:21:53 JST Rich Felker

   Heads up maintainers: there's a static analysis tool Svace, and perhaps some AI-slop tool built on top of it, producing very wrong analysis. So far #musl has gotten 6 patch submissions based on it and they're all wrong and mostly unmotivated.

   In one case it claimed possible null pointer dereference when the code in question was already immediately conditional on the pointer being non-null.

   FWIW this is what Samsung uses to find and "fix" bugs in their fork of Android... 🤦

   • Embed this notice
     cliffle@hachyderm.io's status on Tuesday, 18-Feb-2025 09:23:57 JST cliffle

     in reply to

     @dalias just wanted to leave this here:

     https://link.springer.com/article/10.1134/S0361768814050041

     "acceptable quality of analysis (30-80% of true positive warnings"

     I'm unfamiliar with this journal.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 18-Feb-2025 09:25:01 JST Rich Felker

     in reply to

     • cliffle

     @cliffle Something something false positive paradox...