Using Static Analysis and Clang To Find Heartbleed

Summary: A Trail of Bits researcher wrote an out-of-tree Clang analyzer plugin over a 24-hour period that taints values returned from ntohl/ntohs calls and alerts when those tainted values reach memcpy as a size argument without being constrained by program logic. Because OpenSSL uses its own n2s/n2l macros instead of ntohs/ntohl, the author replaced the n2s macro with a call to a function named xyzzy and adapted the checker to match it, which identified the Heartbleed bug in both locations it was present in OpenSSL.
Bottom line: The checker's constraint reasoning is coarse-grained by the author's own account, so it can flag a tainted value that could exceed 5000 and is passed to memcpy while leaving the analyst to judge whether that is acceptable. The detection also depended on a heuristic about which functions produce attacker-influenced data, and OpenSSL's byte-swapping macros defeated the original ntohs/ntohl assumption outright.

Read the original at Trail of Bits Blog ↗