Can you provide examples for it? Because it honestly doesn't seem like it has ever been done.
Well all of them "potentially" do, which is enough from a security standpoint
There have been enough zero days using memory leaks that we know the percentage is also non trivial.
So yes, if programmers can write bugs they will, google SREs were the first to famously measure bugs per release as a metric instead of the old fashioned (and naive) "we aren't gonna write any more bugs"
sqlite
billions of installations and relatively few incidents
Few incidents != not badly exploitable
Few incidents != no more undiscovered safety bugs/issues
I don't think your examples quite cut it.
Also I believe in entering null values will lead to undefined behaviour.
I'm not sure how you'd enter NULL given scanf.
The program contains potential use of uninitialized memory UB, because scanf error return is not checked and num1 and num2 are not default initialized. And a + b can invoke signed integer overflow UB. A program with more than zero UB cannot be considered memory safe.
For example if the program runs in a context where stdin can't be read scanf will return error codes and leave the memory uninitialized.
especially when you phrase it as
> Can you provide examples for it? Because it honestly doesn't seem like it has ever been done.
it comes off as pedantic and arrogant.
It obviously is possible to write memory safe software in C and obviously it has been done before otherwise we would not be currently communicating over the goddamn internet.
Asking for evidence of something this obvious is akin to asking for a source on if water is in fact wet.
>it comes off as pedantic and arrogant.
Interesting the way this was perceived. I thought he was just asking a honest question.
Again shows online discussion and communication is hard.
Yes it did, of course. Maybe it takes years of practice, the assistance of tools (there are many, most very good), but it's always been possible to write memory safe large C programs.
Sure, it's easier to write a robust program in almost every other language. But to state that nobody ever produced a memory safe C program is just wrong. Maybe it was just rethoric for you, but I'm afraid some may read that and think it's a well established fact.