On Fri, Apr 20, 2012 at 4:53 PM, Jean-Marc Desperrier <jmd...@free.fr>wrote:
> On Tue, 17 Apr 2012, Lubomír Sedlář wrote: >> >>> I would like to ask if any static analysis tool was ever used to detect >>> possible problems in OpenSSL source code. Is some tool used regularly? >>> I tried running Clang Static Analyzer [1] on the source of OpenSSL. >>> >> > Julia Lawall a écrit : > >> A few years ago, we did some experiments on finding problems in error >> handling in OpenSSL using Coccinelle: >> >> Finding Error Handling Bugs in OpenSSL using Coccinelle >> http://coccinelle.lip6.fr/**papers/edcc10.pdf<http://coccinelle.lip6.fr/papers/edcc10.pdf> >> > > It's a bit surprising if none of those tools could identify the badness of > the code involved in the just published memory corruption vulnerability. > Every now and then I look at trying to eliminate the possibility of this kind of bug. Its really hard. I'd be interested if Clang could be persuaded to spot the bug ... even more interested if it could find conversion bugs generically. > > I fail to see anything subtle in that vulnerability. > Now, the trouble might be in the eye of the reviewer who'd assume way too > easily that the downcasting of a long is OK. > > I think it would be really interesting to understand *why* this wasn't > seen earlier, and check all the rest of the code for potentially similar > problem. Or similar case of assuming that "doing this is not very clean but > won't hurt us" instead of cleaning the code to do things properly. The core problem is that the language doesn't do things properly :-) But seriously, this is an important problem that crops up all the time, but is hard to deal with. I've long suspected that a combination of static analysis, good idioms and annotation could go a long way towards making things better, but haven't really had time/energy to do more than speculate______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majord...@openssl.org
