I wonder if any of the existing static code analyzers would have found this?
PVS-Studio checks some open source projects and posts part of the results on their blog. I did a search and found that they did take a look at OpenSSL in 2012.
I wonder how "unvalidated user input passed to memcpy()" didn't trigger all of the static analysers...
I guess that the anaylser doesn't know that it's untrusted - perhaps it's worth having separate "trusted int" and "untrusted int" data types, so this would've been a compile-time error?
Or create a standard of annotations for C, like those used by Java and C#? NotNull, CanBeNull etc, and let the static analyzers use those hints to help even more.
Comments
I wonder if any of the existing static code analyzers would have found this?
PVS-Studio checks some open source projects and posts part of the results on their blog. I did a search and found that they did take a look at OpenSSL in 2012.
http://www.viva64.com/en/b/0183/
And Coverity: https://scan.coverity.com/projects/294
I wonder how "unvalidated user input passed to memcpy()" didn't trigger all of the static analysers...
I guess that the anaylser doesn't know that it's untrusted - perhaps it's worth having separate "trusted int" and "untrusted int" data types, so this would've been a compile-time error?
Or create a standard of annotations for C, like those used by Java and C#? NotNull, CanBeNull etc, and let the static analyzers use those hints to help even more.