This shouldn't have happened: A vulnerability postmortem

Ah; the title means "this shouldn't have happened [because the vender was in fact doing everything right]", not "this shouldn't have happened [because it's so stupid]".

The disclosure and test cases: https://www.openwall.com/lists/oss-security/2021/12/01/4

This sounds like a very good argument for switching over to Rust.

A title that actually describes the post, mostly paraphrasing the first paragraph:

Reasons why this buffer overflow wasn't caught earlier despite doing all the right things

And then to give those reasons:

- "each component is fuzzed independently" ... "This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered."

- "There is an arbitrary limit of 10000 bytes placed on fuzzed input. There is no such limit within NSS; many structures can exceed this size. This vulnerability demonstrates that errors happen at extremes"

- "combined [fuzzer] coverage metrics [...]. This data proved misleading, as the vulnerable code is fuzzed extensively but by fuzzers that could not possibly generate a relevant input."

The conclusion is, of course, to fix those problems if your code base also has them, but also "even extremely well-maintained C/C++ can have fatal, trivial mistakes".

By work? It's pure risk-management, do you need it? Is it worth the potential risk/work?