PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Detecting Iterator Invalidation with CodeQL

blog.trailofbits.com | blog | #vulnerability-research | #vulnerabilities | #static-analysis | #codeql | #cpp | #iterator-invalidation | #undefined-behavior
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Itergator, a set of CodeQL classes and queries built during a Trail of Bits internship, detects C++ iterator invalidation—undefined behavior that often yields exploitable bugs—in real-world code.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Catching OpenSSL misuse using CodeQL
Five CodeQL queries catch OpenSSL libcrypto misuse—short cipher keys, missing entropy initialization, and uncleared bignums—that can cause memory leaks or authentication bypasses in C/C++ codebases.
blog · blog.trailofbits.com
Use constexpr for faster, smaller, and safer code
Because constexpr code cannot invoke undefined behavior, C++14 constexpr eliminates bug classes like silently optimized overflow checks while shrinking binaries. A libclang tool automates this.
research · theori.io
Offensive Security with Large Language Models (2)
Part two of Xint’s LLM offensive-security series: how LLMs assist static analysis where CodeQL falls short on third-party taint specs, plus injection risks in LLM-integrated web apps.
research · blog.quarkslab.com
Back from CppCon 2016
Trip report from CppCon 2016: the C++ Costless Abstractions talk, SCM challenge puzzles, a uftrace poster and sessions on undefined behavior, plus the takeaway that there is always more C++ to learn.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
Back