nu1lptr - SecurityLearner // Cybersecurity Ph.D.@UMich CSE // PhotographerZola2026-09-21T18:00:00-07:00https://shengtuo.me/tags/security/atom.xmlrllvm: From Capture to Query2026-09-21T18:00:00-07:002026-09-21T18:00:00-07:00
Shengtuo Hu
https://shengtuo.me/blog/from-capture-to-query/<h2 id="tl-dr"><a class="zola-anchor" href="#tl-dr" aria-label="Anchor link for: tl-dr"><i class="icon"></i></a>
TL;DR</h2>
<p>The first two posts in this series were about producing artifacts: extracting
<a href="https://shengtuo.me/blog/whole-program-bitcode/">whole-program bitcode</a>, then keeping the
modules and their provenance in a
<a href="https://shengtuo.me/blog/beyond-single-bitcode-file/">catalog</a> instead of merging them away.
<code>rllvm-query</code> adds the step those were building toward. It reads a catalog and
answers questions in source terms: who defines this, who calls it, what does it
call, what path reaches it.</p>
<p>This post puts that step to work on a program written in two languages. The
example is CVE-2026-11941, a use-after-free in Cloudflare's quiche that is made
entirely of safe Rust and still hands C a pointer to freed memory. The queries
locate it, scan the rest of the library for the same shape, and then run out of
road in a place worth being precise about.</p>
<h2 id="a-blind-spot-in-mixed-language-programs"><a class="zola-anchor" href="#a-blind-spot-in-mixed-language-programs" aria-label="Anchor link for: a-blind-spot-in-mixed-language-programs"><i class="icon"></i></a>
A blind spot in mixed-language programs</h2>
<p>Programs written in a single language are becoming the exception. A Rust crate
pulls in a <code>-sys</code> dependency and half of its real work happens in C. A C
codebase adopts Rust one module at a time.</p>
<p>The boundary between the two is the riskiest part of such a program. Ownership
stops being tracked there, error conventions stop matching, and who frees what
has to be written in a comment because no type carries it across. It is also the
one place that ordinary tooling does not look, for an understandable reason:
every ecosystem's index is scoped to its own build. <code>rust-analyzer</code> stops at the
<code>extern "C"</code> declaration, because Cargo compiled nothing past it. <code>clangd</code> never
heard of the Rust caller. <code>cargo audit</code> reasons over the dependency graph, which
suits crates and says nothing about the BoringSSL that a build script compiled
along the way. <code>unsafe</code> marks where Rust stops trusting itself, and stays silent
about the other side.</p>
<p>So the questions that matter most at the boundary are the ones nobody can ask.</p>
<h2 id="getting-both-languages-into-one-module"><a class="zola-anchor" href="#getting-both-languages-into-one-module" aria-label="Anchor link for: getting-both-languages-into-one-module"><i class="icon"></i></a>
Getting both languages into one module</h2>
<p><code>rustc</code> and <code>clang</code> are both LLVM front ends. Once a call across the boundary
becomes an LLVM <code>call</code> instruction, the language has been erased: there is a
caller, a callee, and a source location for each. The boundary belongs to how we
build software rather than to the compiled program, so the whole job reduces to
capturing both halves at once. That used to take one environment variable. Now
it takes two.</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="color:#dbbb3d;">export </span><span style="font-weight:bold;color:#a3cbe3;">CC</span><span style="color:#db7c6d;">=</span><span>rllvm-cc </span><span style="font-weight:bold;color:#a3cbe3;">CXX</span><span style="color:#db7c6d;">=</span><span>rllvm-cxx </span><span style="font-weight:bold;color:#a3cbe3;">RUSTC_WRAPPER</span><span style="color:#db7c6d;">=</span><span>rllvm-rustc
</span></code></pre>
<p>The <a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/tree/main/examples/ffi"><code>examples/ffi</code></a>
directory holds the smallest version of this I could write: two programs whose
call graphs cross the boundary, one led from each language, because the gap in
the tooling runs both ways.</p>
<figure class="ffi-fig ffi-crossings" aria-label="Two small programs whose call graphs cross the FFI boundary, one led from Rust and one led from C">
<div class="ffi-group">
<span class="ffi-kicker">Rust-led</span>
<ol>
<li><span class="ffi-lang is-rust">Rust</span><span class="ffi-fn">main::main</span><span class="ffi-arrow">▸</span><span class="ffi-lang is-c">C</span><span class="ffi-fn">c_double</span><span class="ffi-arrow">▸</span><span class="ffi-lang is-rust">Rust</span><span class="ffi-fn">rust_add</span><span class="ffi-where">main.rs:12</span></li>
<li><span class="ffi-lang is-rust">Rust</span><span class="ffi-fn">main::main</span><span class="ffi-arrow">▸</span><span class="ffi-lang is-cxx">C++</span><span class="ffi-fn">cxx_triple</span><span class="ffi-where">main.rs:13</span></li>
</ol>
</div>
<div class="ffi-group">
<span class="ffi-kicker">C-led</span>
<ol>
<li><span class="ffi-lang is-c">C</span><span class="ffi-fn">main</span><span class="ffi-arrow">▸</span><span class="ffi-lang is-rust">Rust</span><span class="ffi-fn">rust_scale</span><span class="ffi-arrow">▸</span><span class="ffi-lang is-c">C</span><span class="ffi-fn">c_offset</span><span class="ffi-where">c_main.c:8</span></li>
</ol>
</div>
<figcaption>One module holds all three languages, and each crossing is reported at the line that makes the call. Direction matters more than it looks: a Rust staticlib drags in a prebuilt <b>std</b> that never went through the wrapper, so whichever language leads decides how much of the program you can see.</figcaption>
</figure>
<h2 id="a-real-bug-where-the-languages-meet"><a class="zola-anchor" href="#a-real-bug-where-the-languages-meet" aria-label="Anchor link for: a-real-bug-where-the-languages-meet"><i class="icon"></i></a>
A real bug where the languages meet</h2>
<p>quiche is Cloudflare's QUIC and HTTP/3 library: a Cargo workspace that also
builds BoringSSL through a build script and exposes a C API behind a feature
flag. In June it published
<a rel="noopener" target="_blank" href="https://github.com/cloudflare/quiche/security/advisories/GHSA-mh64-ph39-mrc9">GHSA-mh64-ph39-mrc9</a>,
CVE-2026-11941, a use-after-free in two of its FFI functions, fixed in 0.29.2.</p>
<p>The entire defect, from <code>quiche/src/ffi.rs</code> at 0.29.1:</p>
<pre data-lang="rust" style="background-color:#31333d;color:#ffffffc4;" class="language-rust "><code class="language-rust" data-lang="rust"><span style="color:#a3cbe3;">impl</span><span><</span><span style="color:#dbbb3d;">'a</span><span>> Iterator </span><span style="color:#db7c6d;">for </span><span>ConnectionIdIter<</span><span style="color:#dbbb3d;">'a</span><span>> {
</span><span> </span><span style="color:#a3cbe3;">type </span><span>Item </span><span style="color:#db7c6d;">= </span><span>ConnectionId<</span><span style="color:#dbbb3d;">'a</span><span>>;
</span><span>
</span><span> </span><span style="color:#a3cbe3;">fn </span><span style="color:#a2ba43;">next</span><span>(</span><span style="color:#db7c6d;">&</span><span style="color:#dbbb3d;">mut </span><span style="color:#ffffff;">self</span><span>) -> </span><span style="color:#e7e7e7;">Option</span><span><</span><span style="color:#a3cbe3;">Self::</span><span>Item> {
</span><span> </span><span style="color:#a3cbe3;">let</span><span> v </span><span style="color:#db7c6d;">= </span><span style="font-weight:bold;color:#a3cbe3;">self</span><span>.cids.</span><span style="color:#db7c6d;">get</span><span>(</span><span style="font-weight:bold;color:#a3cbe3;">self</span><span>.index)</span><span style="color:#db7c6d;">?</span><span>;
</span><span> </span><span style="font-weight:bold;color:#a3cbe3;">self</span><span>.index </span><span style="color:#db7c6d;">+= 1</span><span>;
</span><span> </span><span style="color:#e7e7e7;">Some</span><span>(v.</span><span style="color:#db7c6d;">clone</span><span>()) </span><span style="color:#707180;">// an owned ConnectionId
</span><span> }
</span><span>}
</span><span>
</span><span>#[</span><span style="font-weight:bold;color:#a3cbe3;">no_mangle</span><span>]
</span><span style="color:#dbbb3d;">pub </span><span style="color:#db7c6d;">extern </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>C</span><span style="font-weight:bold;color:#dbbb3d;">" </span><span style="color:#a3cbe3;">fn </span><span style="color:#a2ba43;">quiche_connection_id_iter_next</span><span>(
</span><span> </span><span style="color:#ffffff;">iter</span><span>: </span><span style="color:#db7c6d;">&</span><span style="color:#dbbb3d;">mut</span><span> ConnectionIdIter,
</span><span> </span><span style="color:#ffffff;">out</span><span>: </span><span style="color:#db7c6d;">&</span><span style="color:#dbbb3d;">mut *const </span><span style="color:#a3cbe3;">u8</span><span>,
</span><span> </span><span style="color:#ffffff;">out_len</span><span>: </span><span style="color:#db7c6d;">&</span><span style="color:#dbbb3d;">mut</span><span> size_t,
</span><span>) -> </span><span style="color:#a3cbe3;">bool </span><span>{
</span><span> </span><span style="color:#db7c6d;">if </span><span style="color:#a3cbe3;">let </span><span style="color:#e7e7e7;">Some</span><span>(conn_id) </span><span style="color:#db7c6d;">=</span><span> iter.</span><span style="color:#db7c6d;">next</span><span>() { </span><span style="color:#707180;">// owned; dropped below
</span><span> </span><span style="color:#a3cbe3;">let</span><span> id </span><span style="color:#db7c6d;">=</span><span> conn_id.</span><span style="color:#db7c6d;">as_ref</span><span>();
</span><span> </span><span style="color:#db7c6d;">*</span><span>out </span><span style="color:#db7c6d;">=</span><span> id.</span><span style="color:#db7c6d;">as_ptr</span><span>(); </span><span style="color:#707180;">// escapes to C
</span><span> </span><span style="color:#db7c6d;">*</span><span>out_len </span><span style="color:#db7c6d;">=</span><span> id.</span><span style="color:#db7c6d;">len</span><span>();
</span><span> </span><span style="color:#db7c6d;">return </span><span style="color:#ffffff;">true</span><span>;
</span><span> } </span><span style="color:#707180;">// conn_id freed here
</span><span>
</span><span> </span><span style="color:#ffffff;">false
</span><span>}
</span></code></pre>
<p>There is no <code>unsafe</code> block. The borrow checker is satisfied and it is right to
be: <code>conn_id</code> is an owned value, dropped correctly at the end of its scope.
Every guarantee Rust makes holds.</p>
<p>What goes wrong is that a raw pointer into that value crossed an <code>extern "C"</code>
signature on the way out, and C reads it after the drop. Rust's ownership model
ends at the signature, and both halves of this program are correct on their own.</p>
<figure class="ffi-fig" aria-label="A timeline showing the ConnectionId being cloned, its pointer escaping to C, the value being dropped, and C reading the freed memory">
<div class="ffi-life">
<div class="ffi-step is-alive"><span class="ffi-side">Rust</span><span class="ffi-what">clone a <b>ConnectionId</b> out of the iterator<span class="ffi-at">ffi.rs:1157</span></span><span class="ffi-bar"></span></div>
<div class="ffi-step is-alive"><span class="ffi-side">Rust</span><span class="ffi-what">*out = id.as_ptr(), the pointer escapes<span class="ffi-at">ffi.rs:1158</span></span><span class="ffi-bar"></span></div>
<div class="ffi-step is-dead"><span class="ffi-side">Rust</span><span class="ffi-what">drop_glue::<ConnectionId>, the buffer is freed<span class="ffi-at">ffi.rs:1162</span></span><span class="ffi-bar"></span></div>
<div class="ffi-return">return to C, and out still holds the pointer</div>
<div class="ffi-step is-dead is-fault"><span class="ffi-side">C</span><span class="ffi-what">fprintf("%02x", cid[i])<span class="ffi-at">cid_logger.c:21</span></span><span class="ffi-bar"></span></div>
</div>
<figcaption>The solid bar is the value's lifetime; the dashed continuation is the pointer outliving it. Only the join between the two halves is wrong, and the join is what neither language's tooling reads.</figcaption>
</figure>
<h2 id="asking-rllvm-query-about-it"><a class="zola-anchor" href="#asking-rllvm-query-about-it" aria-label="Anchor link for: asking-rllvm-query-about-it"><i class="icon"></i></a>
Asking rllvm-query about it</h2>
<p>What follows runs against quiche 0.29.1 with the FFI feature on, plus a small C
program that uses the iterator the way the advisory describes.</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="font-weight:bold;color:#a3cbe3;">git</span><span> clone https://github.com/cloudflare/quiche </span><span style="color:#db7c6d;">&& cd</span><span> quiche
</span><span style="font-weight:bold;color:#a3cbe3;">git</span><span> checkout 0.29.1
</span><span>
</span><span style="color:#dbbb3d;">export </span><span style="font-weight:bold;color:#a3cbe3;">RUSTC_WRAPPER</span><span style="color:#db7c6d;">=</span><span>rllvm-rustc </span><span style="font-weight:bold;color:#a3cbe3;">CC</span><span style="color:#db7c6d;">=</span><span>rllvm-cc
</span><span style="font-weight:bold;color:#a3cbe3;">cargo</span><span> build</span><span style="color:#ffffff;"> -p</span><span> quiche</span><span style="color:#ffffff;"> --features</span><span> ffi
</span><span>
</span><span style="font-weight:bold;color:#a3cbe3;">rllvm-cc</span><span style="color:#ffffff;"> -g -Iquiche</span><span>/include cid_logger.c \
</span><span> target/debug/libquiche.a</span><span style="color:#ffffff;"> -o</span><span> cid_logger
</span><span style="font-weight:bold;color:#a3cbe3;">rllvm-get-bc</span><span> cid_logger</span><span style="color:#ffffff;"> --output-dir</span><span> cat
</span></code></pre>
<p>The binary now records both halves. Every answer below is JSON; I have reduced
each one to the fields under discussion, and shortened Rust crate paths to fit.</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="font-weight:bold;color:#a3cbe3;">CAT</span><span style="color:#db7c6d;">=</span><span>cat/catalog.json
</span><span style="font-weight:bold;color:#a3cbe3;">FN</span><span style="color:#db7c6d;">=</span><span>quiche_connection_id_iter_next
</span></code></pre>
<p>The definition is Rust, and the caller is C, each reported at its own line:</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="font-weight:bold;color:#a3cbe3;">rllvm-query</span><span style="color:#ffffff;"> --catalog </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">CAT</span><span> defs </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">FN
</span><span style="color:#707180;"># quiche/src/ffi.rs:1154
</span><span>
</span><span style="font-weight:bold;color:#a3cbe3;">rllvm-query</span><span style="color:#ffffff;"> --catalog </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">CAT</span><span> callers </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">FN
</span><span style="color:#707180;"># log_source_ids at cid_logger.c:19
</span></code></pre>
<p><code>callees</code> on the FFI function is the bug in three lines. Rust symbols come back
demangled, so a cross-language answer reads as one answer:</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="font-weight:bold;color:#a3cbe3;">rllvm-query</span><span style="color:#ffffff;"> --catalog </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">CAT</span><span> callees </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">FN
</span><span style="color:#707180;"># ffi.rs:1157 <ConnectionIdIter as Iterator>::next
</span><span style="color:#707180;"># ffi.rs:1158 <ConnectionId as AsRef<[u8]>>::as_ref
</span><span style="color:#707180;"># ffi.rs:1162 core::ptr::drop_glue::<ConnectionId>
</span></code></pre>
<p>Clone, take a pointer, free. Run the same query against 0.29.2 and the
<code>drop_glue</code> line is gone, because the fix stopped owning anything:</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="color:#707180;"># ffi.rs:1146 <Vec<ConnectionId> as Deref>::deref
</span><span style="color:#707180;"># ffi.rs:1146 <[ConnectionId]>::get::<usize>
</span><span style="color:#707180;"># ffi.rs:1147 <ConnectionId as AsRef<[u8]>>::as_ref
</span></code></pre>
<p><code>reach</code> walks from the C entry point to the Rust function, and records the
crossing as its own kind of step:</p>
<pre data-lang="json" style="background-color:#31333d;color:#ffffffc4;" class="language-json "><code class="language-json" data-lang="json"><span>[
</span><span> { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">kind</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">call</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>, </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">function</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">symbol</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">main</span><span style="font-weight:bold;color:#dbbb3d;">" </span><span>},
</span><span> </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">block_index</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="color:#db7c6d;">3</span><span>, </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">instruction_index</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="color:#db7c6d;">1 </span><span>},
</span><span> { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">kind</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">call</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>, </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">function</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">symbol</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">log_source_ids</span><span style="font-weight:bold;color:#dbbb3d;">" </span><span>},
</span><span> </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">block_index</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="color:#db7c6d;">1</span><span>, </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">instruction_index</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="color:#db7c6d;">1 </span><span>},
</span><span> { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">kind</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">binding</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>,
</span><span> </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">symbol</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">quiche_connection_id_iter_next</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>,
</span><span> </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">declared_in</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: [ </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">e98486…</span><span style="font-weight:bold;color:#dbbb3d;">" </span><span>],
</span><span> </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">candidates</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: [ { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">function</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: { </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">module_id</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">00a3d4…</span><span style="font-weight:bold;color:#dbbb3d;">" </span><span>} } ],
</span><span> </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">status</span><span style="font-weight:bold;color:#dbbb3d;">"</span><span>: </span><span style="font-weight:bold;color:#dbbb3d;">"</span><span style="color:#ffffff;">unique</span><span style="font-weight:bold;color:#dbbb3d;">" </span><span>}
</span><span>]
</span></code></pre>
<p>Two ordinary calls inside C, then a <code>binding</code>: a C declaration that resolved to
one candidate definition in a Rust module. The answer distinguishes a call it
observed from a link it resolved, and says which one carries the path.</p>
<h2 id="scanning-the-whole-ffi-surface"><a class="zola-anchor" href="#scanning-the-whole-ffi-surface" aria-label="Anchor link for: scanning-the-whole-ffi-surface"><i class="icon"></i></a>
Scanning the whole FFI surface</h2>
<p>Everything above starts from knowing the answer. The more useful question is
whether the bug has a shape you can search for, stated without reference to the
CVE:</p>
<blockquote>
<p>An <code>extern "C"</code> entry point hands C a raw pointer into a value, and then drops
that value before returning.</p>
</blockquote>
<p>In call-graph terms that is two conditions on one function's callees: something
that takes a pointer into <code>T</code>, and <code>drop_glue::<T></code>. Both already appear in the
output, so the scan is a loop.</p>
<pre data-lang="bash" style="background-color:#31333d;color:#ffffffc4;" class="language-bash "><code class="language-bash" data-lang="bash"><span style="font-weight:bold;color:#a3cbe3;">nm</span><span> target/debug/libquiche.a \
</span><span> </span><span style="color:#db7c6d;">| </span><span style="font-weight:bold;color:#a3cbe3;">awk </span><span style="font-weight:bold;color:#dbbb3d;">'</span><span>$2=="T" && $3 ~ /^_quiche_/</span><span style="font-weight:bold;color:#dbbb3d;">' </span><span style="color:#db7c6d;">| </span><span style="font-weight:bold;color:#a3cbe3;">sort</span><span style="color:#ffffff;"> -u </span><span style="color:#db7c6d;">></span><span> surface.txt
</span><span style="font-weight:bold;color:#a3cbe3;">wc</span><span style="color:#ffffff;"> -l </span><span style="color:#db7c6d;"><</span><span> surface.txt </span><span style="color:#707180;"># 169 entry points
</span><span>
</span><span style="color:#db7c6d;">for</span><span> fn </span><span style="color:#db7c6d;">in </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span>(</span><span style="font-weight:bold;color:#a3cbe3;">cat</span><span> surface.txt)</span><span style="color:#db7c6d;">; do
</span><span> </span><span style="font-weight:bold;color:#a3cbe3;">rllvm-query</span><span style="color:#ffffff;"> --catalog </span><span style="font-weight:bold;color:#dbbb3d;">$</span><span style="font-weight:bold;color:#a3cbe3;">CAT</span><span> callees </span><span style="font-weight:bold;color:#dbbb3d;">"$</span><span style="font-weight:bold;color:#a3cbe3;">fn</span><span style="font-weight:bold;color:#dbbb3d;">"
</span><span style="color:#db7c6d;">done
</span><span style="color:#707180;"># keep any whose callees hold both drop_glue::<T>
</span><span style="color:#707180;"># and something that takes a pointer into T
</span></code></pre>
<p>The leading underscore is Mach-O's prefix on C symbols; an ELF build wants
<code>/^quiche_/</code> instead. That platform dependency, and the fact that this step
reaches for <code>nm</code> at all, is a gap: the catalog already knows which functions a
Rust module exported to C, so <code>rllvm-query</code> should be able to list them itself
(<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/issues/243">#243</a>).</p>
<p>169 entry points reduce to 7 candidates, and both functions the advisory names
are among them:</p>
<table><thead><tr><th>Candidate</th><th>Reading it</th></tr></thead><tbody>
<tr><td><code>quiche_connection_id_iter_next</code></td><td><strong>CVE-2026-11941</strong></td></tr>
<tr><td><code>quiche_conn_retired_scid_next</code></td><td><strong>CVE-2026-11941</strong></td></tr>
<tr><td><code>quiche_conn_source_id</code></td><td>safe: the dropped <code>ConnectionId</code> is the borrowed variant</td></tr>
<tr><td><code>quiche_conn_destination_id</code></td><td>safe: the same</td></tr>
<tr><td><code>quiche_accept</code></td><td>filter noise: the match was <code>Option::as_ref</code></td></tr>
<tr><td><code>quiche_conn_new_with_tls</code></td><td>filter noise: the same</td></tr>
<tr><td><code>quiche_h3_take_last_priority_update</code></td><td>safe <em>if</em> the C callback behaves</td></tr>
</tbody></table>
<p>One caveat on how much this proves. I wrote the filter after reading the
advisory. The shape is general, since handing C a pointer into something you
then drop is a whole class of FFI bug. This run still does not establish that I
would have picked it blind. What it does establish is that the class fits in two
predicates over ordinary output, that it ranks both real defects into seven of a
hundred and sixty-nine, and that the signal disappears when the bug is fixed.</p>
<h2 id="does-it-affect-my-build"><a class="zola-anchor" href="#does-it-affect-my-build" aria-label="Anchor link for: does-it-affect-my-build"><i class="icon"></i></a>
Does it affect my build?</h2>
<p><code>cargo audit</code> gives one answer for any quiche below 0.29.2: vulnerable. The
advisory is more careful, and names the thing that actually decides it.</p>
<blockquote>
<p>Only applications using those FFI functions are affected. The FFI API is
disabled by default by a build-time feature flag.</p>
</blockquote>
<p>That is a whole-program question, with four different true answers depending on
how the program was built.</p>
<table><thead><tr><th>Build</th><th>Definition present</th><th>Callers</th><th>What is true</th></tr></thead><tbody>
<tr><td>default features</td><td>no</td><td>n/a</td><td>the code was never compiled</td></tr>
<tr><td><code>--features ffi</code>, quiche's own <code>client.c</code></td><td>yes</td><td>0</td><td>linked in, never called</td></tr>
<tr><td><code>--features ffi</code>, a C app that iterates CIDs</td><td>yes</td><td>1</td><td>reachable</td></tr>
<tr><td>0.29.2, same C app</td><td>yes</td><td>1</td><td>fixed</td></tr>
</tbody></table>
<p>The second row is worth sitting with. <code>nm</code> confirms
<code>_quiche_connection_id_iter_next</code> is in that binary as a defined symbol, and
<code>callers</code> still returns zero. Present and reachable are different facts, and
only one of them describes your risk.</p>
<p>For a caller that does exist, <code>callees</code> on it gives the order of operations, so
you can see what happens after the crossing:</p>
<pre data-lang="txt" style="background-color:#31333d;color:#ffffffc4;" class="language-txt "><code class="language-txt" data-lang="txt"><span>blk 0 #7 line 14 quiche_conn_source_ids
</span><span>blk 1 #1 line 19 quiche_connection_id_iter_next <- the crossing
</span><span>blk 4 #6 line 21 fprintf <- after it
</span><span>blk 6 #1 line 23 fprintf <- after it
</span><span>blk 7 #1 line 26 quiche_connection_id_iter_free
</span></code></pre>
<p>Anything sequenced after the crossing is a candidate consumer of a pointer that
Rust has already freed. The two <code>fprintf</code> calls are a three-line reading window.</p>
<figure class="ffi-fig ffi-funnel" aria-label="Each step narrows the search: 169 FFI entry points, 7 candidates, 1 caller, 3 lines of C to read">
<div class="ffi-rung"><span class="ffi-count">169</span><span class="ffi-track"><span class="ffi-fill" style="--w:100%"></span></span><span class="ffi-label"><b>FFI entry points</b>, listed by nm</span></div>
<div class="ffi-rung"><span class="ffi-count">7</span><span class="ffi-track"><span class="ffi-fill" style="--w:34%"></span></span><span class="ffi-label"><b>candidates</b>: callees take a pointer into T and drop T</span></div>
<div class="ffi-rung"><span class="ffi-count">1</span><span class="ffi-track"><span class="ffi-fill" style="--w:16%"></span></span><span class="ffi-label"><b>caller</b>, with a file and a line</span></div>
<div class="ffi-rung"><span class="ffi-count">3</span><span class="ffi-track"><span class="ffi-fill" style="--w:7%"></span></span><span class="ffi-label"><b>lines of C</b> left to read</span></div>
<figcaption>The bars are illustrative rather than to scale. Every step is mechanical except the last one, which is the point: the tool decides where to look and a person decides what is there.</figcaption>
</figure>
<h2 id="where-the-answers-stop"><a class="zola-anchor" href="#where-the-answers-stop" aria-label="Anchor link for: where-the-answers-stop"><i class="icon"></i></a>
Where the answers stop</h2>
<p>Five of those seven candidates are safe, for two different kinds of reason.</p>
<p><code>ConnectionId</code> is a Cow-like type: <code>enum { Vec(Vec<u8>), Ref(&'a [u8]) }</code>.
<code>quiche_conn_source_id</code> drops one, but it drops the <em>borrowed</em> variant, so the
drop frees nothing and the pointer stays valid. The call graph sees
<code>drop_glue::<ConnectionId></code> either way and cannot separate the two.</p>
<p><code>quiche_accept</code> and <code>quiche_conn_new_with_tls</code> are the cheaper kind of wrong.
Both call <code>Option::as_ref</code>, a borrow helper that hands out no raw pointer at
all, and my filter matched on the method name. Neither function gives C a
pointer into anything it later drops, so the pattern never applied to them.</p>
<p><code>quiche_h3_take_last_priority_update</code> is more interesting. It takes a pointer
into an owned <code>Vec<u8></code>, passes it to a callback supplied by C, and frees the
buffer when the callback returns. Whether that is safe depends on what the C
callback does with the pointer, and the contract lives in a header comment that
nothing enforces. I called it safe above by reading the Rust and assuming the C
behaves. That was an assumption rather than an analysis.</p>
<p>The Cow case and the callback case ask the same question: does this pointer
outlive the value behind it? <code>rllvm-query</code> does not perform data-flow analysis,
so it cannot answer either.
The same limit shows up at indirect calls, where <code>indirect-targets</code> reports a
target set when LLVM recorded one and reports the callback above as unresolved.
Tracking a value through a store, which is how the C side would retain that
pointer, is outside what a call graph describes at all.</p>
<h2 id="what-comes-next"><a class="zola-anchor" href="#what-comes-next" aria-label="Anchor link for: what-comes-next"><i class="icon"></i></a>
What comes next</h2>
<p>Two things, in the order I care about them.</p>
<p>The queries in this post form a short procedure: is the function here, does
anything call it, what happens after the crossing. Two of those steps can end
the investigation early. That belongs in tooling rather than in a blog post.
<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/issues/188">Issue #188</a> is a Claude Code
plugin bundling the MCP server with two skills: how to capture bitcode for the
build in front of you, and how to read an answer without over-claiming it. An
assistant reading source approximates a call graph by matching names, and across
an FFI boundary it cannot even approximate. The early exits matter most, because
"the version range matches, therefore you are affected" is the failure an agent
would otherwise reproduce at scale.</p>
<p>The second is the data flow this post kept needing. I would rather borrow that
than build it. <a rel="noopener" target="_blank" href="https://github.com/secure-software-engineering/phasar">PhASAR</a>
and <a rel="noopener" target="_blank" href="https://github.com/SVF-tools/SVF">SVF</a> have solved pointer and value
analysis for years, and have always taken whole-program C and C++ bitcode.
Getting that file out of a real build was the awkward step they were waiting on.
A module with Rust in it too is new input for tools that already work. Running
them behind the same query contract
(<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/issues/149">#149</a>,
<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/issues/242">#242</a>) is what would separate a
borrowed <code>ConnectionId</code> from an owned one, and say whether a pointer escapes
past a drop. The output should stay evidence: sources, sinks, and the path. A
tool that reports "vulnerable" without showing its work has only moved the
guessing somewhere else.</p>
<p>Indirect calls remain the hard problem they have always been. I do not expect
that to change soon, and the honest move is to keep saying so in the answer.</p>
<hr />
<p><code>rllvm</code> is Apache-2.0 and available on
<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm">GitHub</a>, including the
<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/tree/main/examples/ffi">FFI example</a> and
<a rel="noopener" target="_blank" href="https://github.com/h1994st/rllvm/tree/main/examples/external/quiche">notes on quiche</a>
used here. Measurements were taken on arm64 macOS against quiche 0.29.1 and
0.29.2, built with rustc 1.98.0 and read with LLVM 23.1.1.</p>