Sensing Error Handling Bugs in SSL Library Usages

SSL library plays an important role in ensuring secure connections against remote attacks, and thus the correct usages of SSL library should be guaranteed to avoid security and reliability flaws. However, improper error handling of API function failures frequently happens in SSL library usages, which could introduce security vulnerabilities. To detect such bugs in SSL usages, existing tools need correct error handling specifications. Manually write specifications is tedious and time-consuming. Therefore, a few works towards automatic inferring specifications are presented. However, the principles used in such works are insufficient for SSL library. Thus, in this paper, we first conduct an empirical study of error handling bugs in SSL applications to understand the true nature of such bugs, and the properties of these bugs are summarized, including the frequently used code structure for handling errors, the commonly occurred error-indicating features of the handling actions, and the general bug categories. Based on these properties, we design and implement a tool that can automatically infer error handling specifications and detect error handling bugs by exploiting the specifications in SSL applications. We evaluated our tool on 9 real-world open-source SSL applications. The tool infers 424 specifications in total, out of which 383 are confirmed correct, with a precision of 90%. Moreover, 27 real-world bugs have been detected, and all of them are confirmed by developers.