We Cannot 100% Trust AI-Generated Output: A Concrete Example
The author asked Claude to review his WinReg C++ library. Claude reported bugs in string getters that would crash on zero-length values, but investigation revealed the code was correct. The supposed bug was a false positive, illustrating the need to verify AI suggestions.
Recently I asked Claude to review the code of my WinReg C++ library (which is a C++ high-level wrapper around the low-level C-interface Windows Registry API).
As a result of its analysis, Claude reported that there were zero-length bugs in my code, in particular Claude stated that zero-length REG_SZ/REG_EXPAND_SZ values crash the GetStringValue, GetExpandStringValue, TryGetStringValue and TryGetExpandStringValue methods of the RegKey class.
In particular, Claude noted that I correctly guarded against dataSize == 0 in the binary-returning getters (like RegKey::GetBinaryValue), but the string getters do not have such guard; they unconditionally do:
result.resize((dataSize / sizeof(wchar_t)) - 1);