The Problem with Dynamic Program Analysis
Summary: Trail of Bits describes PointsTo, a whole-program static analysis tool it built that converts source code into LLVM bitcode and tracks how pointers to allocated objects flow through a program to find potential use-after-free bugs. The tool performs context- and path-sensitive pointer analysis to resolve which function pointers point to which functions, then reports flows from FREE assignments to pointer dereferences as source-code slices for expert review.
Key Takeaway: The post argues that dynamic tools like AddressSanitizer and Valgrind only catch bugs on paths a test suite actually exercises, and that large test suites are the exception rather than the rule - so a false-negative is a bug that ships to production. PointsTo was produced for DARPA's Cyber Fast Track program and is used by Trail of Bits consultants in application security reviews.
Read the original at Trail of Bits Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026