Intel's ControlFlag 1.2 Released To Use AI To Provide Full Support For Spotting C++ Bugs

[phoronix]

Phoronix: Intel's ControlFlag 1.2 Released To Use AI To Provide Full Support For Spotting C++ Bugs

Last year Intel open-sourced the ControlFlag project for using machine learning to uncover bugs within code. With today's ControlFlag 1.2 release, C++ is now a fully supported language for this AI-driven project for uncovering bugs within arbitrary code-bases...

https://www.phoronix.com/scan.php?page=news_item&px=Intel-ControlFlag-1.2

[coder]

Hmm... I might give this a whirl and see what it can turn up. Our codebase has already been pretty thoroughly plumbed by conventional analysis tools.

[Eumaios]

If you do, please let us know the results!

[uid313]

ControlFlag supports C, C++ and PHP. They should add support for Python too!
They don't need to add support for Rust though, because Rust code is not gonna have any bugs anyway. 😁

[Vorpal]

So I also decided to give this a try. I tested it on a small C project of my own from some years ago (I mostly do python nowdays). The code in the repository amounts to just under 1 MB according to du -sh. It took about 3 hours to run and found no issues. I ran this on a AMD Ryzen 5 5600X (6 cores, 12 threads) but it only seemed to use 4 threads at most, which is a bit weird. I used the "large" C model mentioned on the web page for the test.

Even if the code was clean (quite possible, back in the day I ran it through several other static analysis tools as well as fuzzing), I wouldn't expect it to take about 3 hours to scan through just under 1 MB of source code. Yes I had enough RAM to run the large model (I have 32 GB RAM in this computer). And no, it did not seem to try to use the GPU for any sort of machine learning acceleration (I have a GTX 1070 in this desktop).

So yeah, not very impressed.

[Nth_man]

It took about 3 hours to run and found no issues.

Have you tried putting intentional bugs to see if it detects any of them? 🤔

[Jabberwocky]

From a business or productivity perspective it seem like a useful tool. I still can't help to think about some lectors that would be "disappointed" if professional people relied on this method for their software to be successful.

It's like plagiarism with less steps. xD

[milkylainen]

Easy.

"How many bugs does this C++ program have?"

...

"Yes."

[coder]

Could this be the beginning of the end of bug bounties?

dbbug.jpg

[kylew77]

I would LOVE for someone to run the OpenBSD kernel through this tool and see how many bugs it finds. In theory the continuous code audit should have spotted most of the bugs, but to err is human, so I wouldn't be surprised if it found a few!