Warning
If someone is reading this blog, please be aware that the writer did not consider the experience of the other readers.
After all, the most important part is about writing things down for better memorization.
Valgrind is an instrumentation framework for building dynamic analysis tools. There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail.
The tool does it’s job by modifying some of the assembly code which is assosiated to memory operation, like call malloc or load/store, when executing the code.
It is doing what we call ‘dynamic analysis’, which is run the program and watch what it does.
Though it is able to detect heap-based buffer overflows, valgrind cannot detect stack-based buffer overflows, as it does not know the source code of the program and has no idea about the stack layout.
Instead of instrumenting binary file like Valgrind does, it instruments the source code.
There’re several kinds of sanitizers, including memory sanitizer, leak sanitizer, undefined behavior sanitizer and thread sanitizer.
Dynamic analysis can only report bad behavior that actually happened.
The program might crash due to some specific input from the user which is probably not going to show up during the test/dynamic analysis.
This leads to the fact that, we just can’t find lots of the issues before it happens. There’re just too much possible issues.
A very simple but extremely effective way to find bugs.
AFL & libfuzzer
Still can not provide any guarantees that a program is bug-free.
Static analyzers could be helpful when finding bugs in the code by doing data-flow analysis. It can detect some edge cases that dynamic analysis might never be able to run into.
However, static analyzers can report a lot of false positives, which means that reporting bugs that could only be triggerred theoratically and impossible in real world.
Also, tracing every possible control flow could be a very cpu-consuming job.
Plus a whole bunch of potential problems. There’re just too many possible issues that exceeds the limit of code analysis.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。