It's almost as if you should understand security critical C code before you start patching it to death.