OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: static analysis
From: Cooper (CooperLinuxfan.com)
Date: Fri Jun 30 2000 - 12:44:12 CDT

Horst von Brand wrote:
>
> I've got a much easier one:
>
> gcc -Wall -Wmissing-prototypes -Wmissing-declarations
>
> See? No Perl hackery required. Will even catch many other errors the
> proposal didn't.

This doesn't work because at compile time the contents of the formatting
string is unknown. Because of that gcc won't scream about this.

Really crappy example:

#include <stdio.h>

int main(void)
{ char input[2000];
        char output[3000];
        int first=1,second=2,third=3;
        scanf("%2000s",input);
        sprintf(output,input,first,second,third);
        return 0;
}

Yeah, I know, when you see code like this you check that business card
again to make sure it really does say "programmer" on it. It's crap and
I know it. It's just to make a point.

Cooper 

-- 
If you can read this you're probably not dead yet.
	- Johnny The Homicidal Maniac 7 -