Yes. There's a good article here explaining why various static analysis tools didn't catch Heartbleed: https://dwheeler.com/essays/heartbleed.html https://dwh

Yes. There's a good article here explaining why various static analysis tools didn't catch Heartbleed: https://dwheeler.com/essays/heartbleed.html https://dwheeler.com/essays/heartbleed.html >It is known that OpenSSL does not directly allocate and deallocate memory directly using standard calls. Instead, it used a caching freelist system internal to OpenSSL to reuse allocated memory. Since OpenSSL does not return (deallocate) memory back to the underlying system once it was done with it (in some cases), special tools could fail to detect some common weaknesses such as use-after-free or double-free that they would otherwise find. It also sometimes prevented some operating system and run-time mitigation mechanisms from working. In short, it is widely agreed that this OpenSSL memory allocation approach prevented many mitigation and weakness detection mechanisms from working.