[nojvek]

Covering the every single branch of code isn’t enough. One needs to test that every single branch isn’t vulnerable to an overflow attack.

It’s kind of testing every possible valid, invalid and malicious input the program can take in.

Gets even crazier with race conditions and such.

Testing is really hard. And given how many companies skip on testing I am led to believe security is a myth. There’s gonna be someone somewhere with an exploit getting your info.

[eridius]

Yeah, which is why fuzzing is important even with tests covering every code path. And even with that, this is why I simply said that SQLite is probably the codebase that comes the closest, rather than saying it actually is bug-free.