Watch out for missed warnings on vendor C++ toolchains

#1

Post by luu » Tue, Jul 28, 2026, 11:29 PM UTC

Watch out for missed warnings on vendor C++ toolchains
blog.poly.nomial.co.uk

Re: Watch out for missed warnings on vendor C++ toolchains

#2

Post by addaon » Wed, Jul 29, 2026, 10:05 PM UTC

So, uh, what happened next? Clearly this code never worked. Was it dead code? Did the vendor explain how their test suite could have missed this? Did you disqualify the vendor entirely? If not, how did you proceed with the rest of the audit knowing that this level of incompetence made it to shipping?

Re: Watch out for missed warnings on vendor C++ toolchains

#3

Post by rurban » Thu, Jul 30, 2026, 1:33 PM UTC

addaon wrote: post #2

So, uh, what happened next? Clearly this code never worked. Was it dead code? Did the vendor explain how their test suite could have missed this? Did you disqualify the vendor entirely? If not, how did you proceed with the rest of the audit knowing that this level of incompetence made it to shipping?

I had to reverse engineer Chinese SDK's for various embedded chips. Their libs were full of this shit. It works in some cases, but rarely in all. In embedded you can thankfully throw this shit out and replace it.