What kind of process or static analysis would catch the heart bleed bug other than human code reviews which we already know failed. The Fix Commit is here.


One common solution is to use managed languages. Languages like Java have bounds checking and memory clearing on assignment that would prevent the issue. The Java VM has been getting very fast after years and years of work and sometimes even beats C code nowadays, so the performance hit isn't as great as you would expect. And high performance isn't required for all coding projects anyway.

Another common solution being discussed is to not reimplement core library functions in your own code. The built-in malloc on Linux and other modern systems has config options to clear the memory to prevent sensitive things from being accessed for example, as well as guard pages to help prevent reading too far. OpenSSL has their own memory allocation, however, so wasn't able to take advantage of common C support and tools to mitigate issues: http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf

Using core functions would have helped analysis tools like Valgrind catch the problem as well.

  • 1
    Note that using managed languages may lead to other problems, though. You really need fine-grained control over the complete performance of your crypto routines. You not only need to make sure that they aren't too slow, you also need to make sure that they aren't "too fast"! Otherwise, you are wide-open to timing attacks. Apr 11 '14 at 23:20
  • Strictly speaking, the relevant property is memory safety, not the (broader and ill-defined) "managed-ness". I mention this because some memory safe languages don't rely on GC, reference types, etc. for memory safety. Crypto code is systems code (in the sense of C, not in the sense of Go), and features associated with "managed" languages interact poorly with the demands of that domain (see also Jörg's comment above). The only remotely popular and mature example of that is Rust, but I hope that design niche becomes more popular in the near future.
    – user7043
    Apr 12 '14 at 10:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.