Lackwit analysis
Approximate (may return false positives)
Conservative (may not return false negatives) under some conditions
- C’s type system has holes
- Lackwit makes assumptions similar to those made by programmers (e.g., “no out-of-bounds memory accesses”)
- Lackwit is unsound only for programs that don’t satisfy these assumptions