Suppose I was to search a file for dangerous C functions:
Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of bounds checking for a given buffer in a scriptable way? One reason why this may not be obvious is that jumps near the functions in question may optimized into positions which at first glance are not related to the original function. I also imagine that bounds checks may look different in compiler generated, programmer generated, and optimized forms.
The ultimate goal is to search the binary for exploitable functions, while reducing the need to hand check each function, or run noisy dynamic analysis tools.
I imagine this may come into play: http://en.wikipedia.org/wiki/Bounds-checking_elimination#In_natively_compiled_languages
The Way I See the Problem:
Although I would very much like to be able to verify this with a small python, or BASH script, I can see how this might be very complex. To fully verify that a function is bounds checked, or not, you might need to trace where its inputs are coming from up to their initial source, and insure that there are not any execution paths which circumvent the check. In that case, I imagine that the script in question would have to map the entire flow of execution of the whole program for this work.
I think my best hope is a way to search an IDA Pro database for this kind of relationship.