What kind of processes or static alaysis would you use to catch impropper buffer bugs such as the one that caused heartbleed? [closed]

Question

Closed. This question needs to be more focused. It is not currently accepting answers.

---

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 6 years ago.

Improve this question

What kind of process or static analysis would catch the heart bleed bug other than human code reviews which we already know failed. The Fix Commit is here.

Answer 1

One common solution is to use managed languages. Languages like Java have bounds checking and memory clearing on assignment that would prevent the issue. The Java VM has been getting very fast after years and years of work and sometimes even beats C code nowadays, so the performance hit isn't as great as you would expect. And high performance isn't required for all coding projects anyway.

Another common solution being discussed is to not reimplement core library functions in your own code. The built-in malloc on Linux and other modern systems has config options to clear the memory to prevent sensitive things from being accessed for example, as well as guard pages to help prevent reading too far. OpenSSL has their own memory allocation, however, so wasn't able to take advantage of common C support and tools to mitigate issues: http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf

Using core functions would have helped analysis tools like Valgrind catch the problem as well.