Lackwit analysis
•Approximate (may return false positives)
•Conservative (may not return false negatives) under some conditions
–C’s type system has holes
–Lackwit makes assumptions similar to those made by programmers (e.g., “no out-of-bounds memory accesses”)
–Lackwit is unsound only for programs that don’t satisfy these assumptions