Post #3657738

2026-07-07 19:12 UTC

OK, code geeks - way back when I was freelancing (20-noughties), I used a tool called 'purify' as a C compiler preprocessor, and it could spot buffer overruns (and much more, but those were the biggies for what we were doing at the time). Later (couple of decades?) 'purify' was gone having been, I think bought out by IBM and then killed? Anyway, later, there was a tool called 'valgrind', which I never got along with, and maybe could have done this, but the learning curve was silly-steep. There *must* be something out right now in the FOSS community which can do this on a Linux box, no?

Replies (4)

@mykter@infosec.exchange 2026-07-07 20:57

@bytebro@mastodonapp.uk I think clang’s sanitizers (and probably gcc too now?) are a similar shape: runtime instrumentation to detect dangerous behaviour.

Open ##3657737
@liiwi@mastodon.social 2026-07-07 19:25

@bytebro@mastodonapp.uk rust compiler? Ok, I'll get my coat...

Open ##3783375
@JdeBP@mastodonapp.uk 2026-07-07 21:01

@bytebro@mastodonapp.uk Apart from valgrind? https://tracker.debian.org/pkg/valgrind #valgrind #Debian

Open ##3783382
@paulf@mastodon.bsd.cafe 2026-07-13 16:22

@bytebro@mastodonapp.uk Originally Purify was developed by Pure Software. They merged with Atria. The merged company was bought by Rational who were bought by IBM. IBM sold PuifyPlus to UNICOM. As such it still exists https://www.unicomsi.com/products/purifyplus/ Free alternatives exist. Sanitizers work in a similar way to Purify (build time instrumentation). Sanitizers have separate functionality in Address Sanitizer (ASAN) and Memory Sanitizer (MSAN). You can't use them together and MSAN is only available with the LLVM toolchain. Valgrind is still going. I don't find it too difficult to use, but I do rather see it from the inside as it were.

Open ##3804041