IntPatch: Automatically Fix Integer-Overflow-to-Buffer-Overflow Vulnerability at Compile-Time
Lecture notes in computer sciencePublished 1 January 2010
Chao Zhang, Tielei Wang, Tao Wei, Yu Chen, Wei Zou
Citations48
SJR quartileQ2
SJR score0.35
SNIP0.55
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
The design and implementation of IntPatch is presented, a compiler extension for automatically fixing IO2BO vulnerabilities in C/C++ programs at compile time, and it provides an interface for programmers to facilitate checking integer overflows.
Abstract
The Integer-Overflow-to-Buffer-Overflow (IO2BO) vulnerability is an underestimated threat. Automatically identifying and fixing this kind of vulnerability are critical for software security. In this paper, we present the design and implementation of IntPatch, a compiler extension for automatically fixing IO2BO vulnerabilities in C/C++ programs at compile time. IntPatch utilizes classic type theory and dataflow analysis framework to identify potential IO2BO vulnerabilities, and then instruments programs with runtime checks. Moreover, IntPatch provides an interface for programmers to facilitate checking integer overflows. We evaluate IntPatch on a number of real-world applications. It has caught all 46 previously known IO2BO vulnerabilities in our test suite and found 21 new bugs. Applications patched by IntPatch have a negligible runtime performance loss which is averaging about 1%.
Keywords
Computer Science
KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs
2,681 Citations2008Cristian Cadar, Daniel Dunbar +1 more
A new symbolic execution tool, KLEE, capable of automatically generating tests that achieve high coverage on a diverse set of complex and environmentally-intensive programs, and significantly beat the coverage of the developers' own handwritten test suite is presented.
ACM Transactions on Programming Languages and SystemsEfficiently computing static single assignment form and the control dependence graph
2,230 Citations1991Ron K. Cytron, Jeanne Ferrante +3 more
New algorithms that efficiently compute static single assignment form and control dependence graph data structures for arbitrary control flow graphs are presented and it is given that all of these data structures are usually linear in the size of the original program.
CUTE
1,653 Citations2005Koushik Sen, Darko Marinov +1 more
A method to represent and track constraints that capture the behavior of a symbolic execution of a unit with memory graphs as inputs is developed and an efficient constraint solver is proposed to facilitate incremental generation of such test inputs.
DART
1,501 Citations2005Patrice Godefroid, Nils Klarlund +1 more
DART is a new tool for automatically testing software that combines three main techniques, automated extraction of the interface of a program with its external environment using static source-code parsing, and dynamic analysis of how the program behaves under random testing and automatic generation of new test inputs to direct systematically the execution along alternative program paths.
EXE
789 Citations2006Cristian Cadar, Vijay Ganesh +3 more
This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code instead of running code on manually or randomly constructed input, and solves the current path constraints to find concrete values using its own co-designed constraint solver, STP.
USENIX Security SymposiumNon-control-data attacks are realistic threats
473 Citations2005Shuo Chen, Jun Xu +3 more
It is demonstrated that many real-world applications, including FTP, SSH, Telnet, and HTTP servers, are vulnerable to non-control-data attacks, and the importance of future research efforts to address this realistic threat is emphasized.
Flow-sensitive type qualifiers
377 Citations2002Jeffrey S. Foster, Tachio Terauchi +1 more
An efficient constraint-based inference algorithm is obtained that integrates flow-insensitive alias analysis, effect inference, and ideas from linear type systems to support strong updates.
A theory of type qualifiers
263 Citations1999Jeffrey S. Foster, Manuel Fähndrich +1 more
A framework for adding type qualifiers to a language that extends standard type rules to model the flow of qualifiers through a program, where each qualifier or set of qualifiers comes with additional rules that capture its semantics.
Dynamic test generation to find integer bugs in x86 binary linux programs
202 Citations2009Dávid Molnár, Xue Cong Li +1 more
New methods for discovering integer bugs using dynamic test generation on x86 binaries using SmartFuzz and the black-box fuzz testing tool zzuf are introduced, and key design choices in efficient symbolic execution of such programs are described.
IntScope: Automatically Detecting Integer Overflow Vulnerability in X86 Binary Using Symbolic Execution.
166 Citations2009Tielei Wang, Tao Wei +2 more
This paper presents a system, IntScope, which can automatically detect integer overflow vulnerabilities in x86 binaries before an attacker does, with the goal of finally eliminating the vulnerabilities.
FigshareRICH: Automatically Protecting Against Integer-Based Vulnerabilities
112 Citations2018David Brumley, Tzi‐cker Chiueh +3 more
RICH (Run-time Integer CHecking), a tool for efficiently detecting integer-based attacks against C programs at run time, is presented and it is shown that safe and unsafe integer operations in C can be captured by well-known sub-typing theory.
A data-driven finite state machine model for analyzing security vulnerabilities
42 Citations2004Shuo Chen, Zbigniew Kalbarczyk +2 more
This paper combines an analysis of data on security vulnerabilities (published in Bugtraq database) and a focused source-code examination to develop a finite state machine (FSM) model to depict and reason about security vulnerabilities.
IEEE Security & PrivacyThe rising threat of vulnerabilities due to integer errors
25 Citations2003David Ahmad
The article explains the vulnerabilities, and offers guidelines to prevent the introduction of these flaws, and describes how to maintain awareness of the risks during software development.
Lecture notes in computer scienceARCHERR: Runtime Environment Driven Program Safety
23 Citations2004R. Chinchani, Anusha Iyer +2 more
Archerr is developed, an automated one-pass source-to-source transformer that derives appropriate architecture dependent runtime safety error checks and inserts them in C source programs and demonstrates the efficacy of the technique on versions of C programs with known vulnerabilities such as Sendmail.
Lecture notes in computer scienceUsing Type Qualifiers to Analyze Untrusted Integers and Detecting Security Flaws in C Programs
19 Citations2006Ebrima N. Ceesay, Jingmin Zhou +3 more
This work presents an approach to automatically detect potential integer misuse, such as integer overflows in C programs, based on CQual, a static analysis tool using type theory.