Let us presume we have a big pile of.. many c- like source code, example: an OS and repositories code.
The question: In general, how can we search for malicious code? What automated (?) softwares are there to run it on the code?
OS is a UNIX-like OS, ex.: BSD, Linux
Should be a "free" solution.
That is quite a tricky question.
Usually when you have a set of unit and integration tests you simply compile the program with the different sanitizers enabled and run tests. If there are loose ends, like out of bounds writes or double free, etc. the sanitizers will stop execution and point to the line in the source code where it happened. Those sanitizers are bundled with GCC and Clang (https://clang.llvm.org/docs/index.html Ctrl+F “Sanitizer”) [License: BSD-like LLVM Release License].
If you do not have sufficient code coverage by tests or the code does not have any tests at all or the code is not available because it is a proprietary software, you have to fall back to fuzzing. Basically it means that you feed the program with random data to make it crash. One popular tool for fuzzing is the american fuzzy lop [License: Apache 2].
