Comments (2)
Adding always-on assertions about things like array bounds
What exactly are you calling for?
I don't think anything similar to the following snippet would really help as it would be just duplicity and would not provide any additional value:
for(i = 0; i < n; i++) {
assert(i < n);
...
}
(Accessing any array outside similar loop is very rare, if present at all, in the source code.)
Intensive, repeated fuzzing with tools like afl-fuzz.
I take code correctness seriously, so I registered MD4C on Coverity Scan to perform static analysis of the code, and also collecting coverage info from the unit testing so we get an idea what code is covered by tests and what not.
Yes, I also scrutinized MD4C with afl-fuzz and with valgrind for several days on my Linux box, and I plan to repeat that after any substantial change in the source code. It already identified some bugs (e.g. #10 and numerous others found & fixed before upstreaming some patches).
On the other side, I cannot dedicate a machine for some ongoing/continuous fuzzing. It's more or less one-person pet project and I have also other projects.
I hope that in the future, MD4C could be added to Google's OSS Fuzz, when it gets open to broader set of projects.
Any better ideas? Or are you willing to provide run-time on your machine?
Security auditing
Yes. That would be cool. But I cannot do it, as it would hardly be an independent audit. So we need another (highly competent) volunteer to do it, or someone willing to pay for it. Are you any of those?
from md4c.
Closing. This is kind of meta-bug, which can never be really completely fulfilled.
from md4c.
Related Issues (20)
- code spans differ - cmark vs md2html
- OSS-Fuzz issue 65943 HOT 1
- permissive url ending with slash not recognized
- code spans differ - cmark vs md2html (reprise)
- md2html not outputing <meta charset="UTF-8"> HOT 5
- "shadowed" variables warning HOT 2
- Pathological input
- pathologic input: O(n^2) with link ref. defs HOT 1
- Adding an HTML to Markdown parser/converter (html2md) HOT 5
- Improve strikethrough around double quotes HOT 1
- Strikethrough with punctuation special case HOT 2
- compatibility: initial tab replaced by four spaces HOT 2
- TAB in heading HOT 1
- spurious hard break after html tag HOT 1
- Some character sequences break URL detection HOT 1
- Feature request: option to output `$` or `\(` instead of `<x-equation>` in html output
- feature idea: special attributes from PHP Markdown Extra
- [question] Parser and try find custom link
- parse markdown crashed
- Table support differences vs. `cmark-gfm`
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from md4c.