3 ms·

> Most static code analyzers could have caught this particular bug Does that mean nobody out there in the crypto world ran a static analyzer on OpenSSL in the

• nuncanada 13y ago
  OpenSSL's code uses particularly bad MACRO's ifdefs that defeat static analyzer's capabilities to analyze the code...
  • notacoward 13y ago
    I'm not sure how much those macros affect anything here. For one thing, most static analyzers are actually very good at cutting through that kind of crap, running its analyses on code that has already been pre-processed using exactly the same command-line flags as the real compiler saw. Even if that weren't the case, I think this particular bug would still qualify as low-hanging fruit. It doesn't involve a lot of macros. It doesn't involve dynamically assigned function pointers. It's not limited to one execution through multiple iterations of a complex loop. I'm painfully familiar with the constructs that can defeat static analysis, and none of them seem present in this case. The code allocates a buffer of size N, then reads from an offset that's not checked to be less than N. That's kind of Static Analysis 101. My biggest worry here, TBH, is that static analysis was done, and this was flagged, but it was buried among so many other reports - many of them false negatives - that nobody paid any attention. That would be truly sad.
    • notacoward 13y ago
      Meant to say "false positives" but it's too late to edit. IRTE
• DanBC 13y ago
  ... And wasn't the Debian bug caused by someone running a tool against the code and trusting the tool?
  • notacoward 13y ago
    Yeah, and I've heard that one guy died because he got tangled up in his climbing rope too. Those things are dangerous, nobody should use them.