Using Static Analysis and Clang To Find Heartbleed

Published

2014-04-27 16:25

Collected

2026-07-05 06:12

---
id: 3792
title: "Using Static Analysis and Clang To Find Heartbleed"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2014/04/27/using-static-analysis-and-clang-to-find-heartbleed/"
published_at: "2014-04-27T16:25:50Z"
tags: ["openssl", "static-analysis", "vulnerability-detection", "compilers", "clang", "heartbleed"]
phying_url: "https://phying.com/item/3792"
lang: en
---

# Using Static Analysis and Clang To Find Heartbleed

## Summary

Trail of Bits built a Clang analyzer plugin that statically detects Heartbleed-style bugs: it taints ntohl/ntohs return values and flags unconstrained data used as memcpy sizes, tested on OpenSSL.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2014-04-27T16:25:50Z
- **Original:** https://blog.trailofbits.com/2014/04/27/using-static-analysis-and-clang-to-find-heartbleed/
- **Phying News:** https://phying.com/item/3792