Finding Error Handling Bugs in OpenSSL Using Coccinelle - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2010

Finding Error Handling Bugs in OpenSSL Using Coccinelle

Julia Lawall
Ben Laurie
  • Function : Author
  • PersonId : 951945
René Rydhof Hansen
  • Function : Author
  • PersonId : 850271

Abstract

OpenSSL is a library providing various functionalities relating to secure network communication. Detecting and fixing bugs in OpenSSL code is thus essential, particularly when such bugs can lead to malicious attacks. In previous work, we have proposed a methodology for finding API usage protocols in Linux kernel code using the program matching and transformation engine Coccinelle. In this work, we report on our experience in applying this methodology to OpenSSL, focusing on API usage protocols related to error handling. This work has resulted in detection of over 30 bugs in a recent snapshot of OpenSSL, and in many cases it was possible to correct the bugs automatically. Our patches correcting these bugs have been accepted by the OpenSSL developers. This work furthermore confirms the applicability of our methodology to user-level code.

Dates and versions

hal-00940375 , version 1 (31-01-2014)

Identifiers

Cite

Julia Lawall, Ben Laurie, René Rydhof Hansen, Nicolas Palix, Gilles Muller. Finding Error Handling Bugs in OpenSSL Using Coccinelle. European Dependable Computing Conference, Apr 2010, Valencia, Spain. pp.191-196, ⟨10.1109/EDCC.2010.31⟩. ⟨hal-00940375⟩
10301 View
0 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More