Question III: [10 marks] a) A program P contains 11 buggy statements: statement# 10, 11, 14, 16, 18, 30, 40, 81, 91, and 99. Three static analysis tools T1, T2, and T3 are used to analyze P. The analysis results are as follows: T1 reported 5 buggy statements: statement# 10, 11, 15, 16, and 20 T2 reported 6 buggy statements: statement# 11, 14, 15, 16, 20, and 81 T3 reported 7 buggy statements: statement# 12, 13, 15, 16, 40, 50, 81, and 91 You would like to choose the best of the three tools based on the F1_measure evaluation metric. Which tool you will choose? Show your calculations. [3 marks] Note that: F1_measure =(2TP)/ (2TP + FP+ FN) b) Following code fragment shows the Apple goto fail; goto fail; bug... if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) goto fail; goto fail; other checks fail: buffer frees (cleanups) return err; 1. What kind of attack was possible because of this vulnerability? [1 mark] 2. Which tool could have found this bug? Is it a security specific tool or non- security specific tool? [2 marks] c) Mention four different types of results/responses that fuzz testing tools can monitor in addition to crash/hang. What is the next step after we find that a software crashed from a fuzz testing? [4 marks]