Re: [xine-devel] review code for stack overflows

[Michael R. <mr...@us...>]

Hi,

> > Valgrind does not verify code. Valgrind is a very useful debugging tool
> > to analyze a problem once it appears. But valgrind cannot find a problem
> > unless you find program input that triggers it.
>
> I normally use valgrind in combination of _certain_ static functions that i
> only use when debugging; for example a printobject function, and it
> displays every item in a certain struct with a little text, since
> everything is accessed, valgrind can check everything, and if it's all
> within borders, you can just browse, and sometimes see unexpected results,
> which lay at the foundation of certain problems... (for now, or for
> later...)

But will you find this problem:

void some_function(char *user_input)
{
  char string[1024];
  sprintf(string, "user entered: %s", user_input);
}

Michael

-- 
# Basic IBM dingbats, some of which will never have a purpose clear
# to mankind
	2.4.0 linux/drivers/char/cp437.uni