CCured in the real world

ACM SIGPLAN Notices

Volumn 38, Issue 5, 2003, Pages 232-244

  Condit, Jeremy ^a   Harren, Matthew ^a   McPeak, Scott ^a   Necula, George C ^a   Weimer, Westley ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

C; Compatibility with library code; Memory safety; Run time type information; Type safety

Indexed keywords

ALGORITHMS; CODES (SYMBOLS); DATA STRUCTURES; DIGITAL ARITHMETIC; DIGITAL LIBRARIES; ERROR CORRECTION; LISP (PROGRAMMING LANGUAGE); METADATA; PROGRAM DEBUGGING; SECURITY OF DATA; SOFTWARE ENGINEERING; STORAGE ALLOCATION (COMPUTER);

LIBRARY CODE; POINTER; RUN TIME; WEB SERVER;

C (PROGRAMMING LANGUAGE);

EID: 1442288707     PISSN: 03621340     EISSN: None     Source Type: Journal    
DOI: 10.1145/780822.781157     Document Type: Conference Paper

References (28)

1. M. Abadi, L. Cardelli, B. Pierce, and G. Plotkin. Dynamic typing in a statically typed language. ACM Transactions on Programming Languages and Systems, 13(2):237-268, April 1991.
2. T. M. Austin, S. E. Breach, and G. S. Sohi. Efficient detection of all pointer and array access errors. SIGPLAN Notices, 29(6):290-301, June 1994. Proceedings of the ACM SIGPLAN '94 Conference on Programming Language Design and Implementation.
3. M. C. Carlisle. Olden: Parallelizing Programs with Dynamic Data Structures on Distributed-Memory Machines. PhD thesis, Princeton University Department of Computer Science, June 1996.
4. R. Cartwright and M. Fagan. Soft typing. In Proceedings of the '91 Conference on Programming Language Design and Implementation, pages 278-292, 1991.
5. CERT Coordination Center. Cert advisory ca-2003-12: Buffer overflow in sendmail. http://www.cert.org/advisories/CA-2003-12.html, 2003.
6. S. Chandra and T. Reps. Physical type checking for C. In Proceedings of the ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, volume 24.5 of Software Engineering Notes (SEN), pages 66-75. ACM Press, Sept. 6 1999.
7. J. S. Foster, M. Fähndrich, and A. Aiken. A theory of type qualifiers. In Proceedings of the ACM SIGPLAN '99 Conference on Programming Language Design and Implementation, pages 192-203, Atlanta, Georgia, May 1-4, 1999.
8. R. Hastings and B. Joyce. Purify: Fast detection of memory leaks and access errors. In Proceedings of the Usenix Winter 1992 Technical Conference, pages 125-138, Berkeley, CA, USA, Jan. 1991. Usenix Association.
9. F. Henglein. Global tagging optimization by type inference. In Proceedings of the 1992 ACM Conference on LISP and Functional Programming, pages 205-215, 1992.
10. T. Jim, G. Morrisett, D. Grossman, M. Hicks, J. Cheney, and Y. Wang. Cyclone: A safe dialect of C. In USENIX Annual Technical Conference. Monetery, CA, June 2002.
11. R. W. M. Jones and P. H. J. Kelly. Backwards-compatible bounds checking for arrays and pointers in C programs. AADEBUG, 1997.
12. S. Kaufer, R. Lopez, and S. Pratap. Saber-C: an interpreter-based programming environment for the C language. In Proceedings of the Summer Usenix Conference, pages 161-171, 1988.
13. A. Kind and H. Friedrich. A practical approach to type inference for EuLisp. Lisp and Symbolic Computation, 6(1/2):159-176, 1993.
14. A. Loginov, S. Yong, S. Horwitz, and T. Reps. Debugging via run-time type checking. In Proceedings of FASE 2001: Fundamental Approaches to Software Engineering, Apr. 2001.
15. G. C. Necula, S. McPeak, and W. Weimer. CCured: Type-safe retrofitting of legacy code. In The 29th Annual ACM Symposium on Principles of Programming Languages, pages 128-139. ACM, Jan. 2002.
16. H. Patil and C. N. Fischer. Efficient run-time monitoring using shadow processing. In Automated and Algorithmic Debugging, pages 119-132, 1995.
17. H. Patil and C. N. Fischer. Low-cost, concurrent checking of pointer and array accesses in C programs. Software - Practice and Experience, 27(1):87-110, Jan. 1997.
18. G. Ramalingam, J. Field, and F. Tip. Aggregate structure identification and its application to program analysis. In Symposium on Principles of Programming Languages, pages 119-132, Jan. 1999.
19. SecuriTeam.com. PHP3/PHP4 format string vulnerability. http://www.securiteam.com/securitynews/6O00T0K03O.html, Dec. 2000.
20. J. Seward. Valgrind, an open-source memory debugger for x86-GNU/Linux. Technical report, http://developer.kde.org/~sewardj/, 2003.
21. M. Shields, T. Sheard, and S. L. P. Jones. Dynamic typing as staged type inference. In Symposium on Principles of Programming Languages, pages 289-302, 1998.
22. M. Siff, S. Chandra, T. Ball, K. Kunchithapadam, and T. Reps. Coping with type casts in C. In 1999 ACM Foundations on Software Engineering Conference (LNCS 1687), volume 1687 of Lecture Notes in Computer Science, pages 180-198. Springer-Verlag/ACM Press, September 1999.
23. G. Smith and D. Volpano. A sound polymorphic type system for a dialect of C. Science of Computer Programming, 32(1-3):49-72, 1998.
24. SPEC 95. Standard Performance Evaluation Corporation Benchmarks. http://www.spec.org/osg/cpu95/CINT95, July 1995.
25. S. Thatte. Quasi-static typing. In Conference record of the 17th ACM Symposium on Principles of Programming Languages (POPL), pages 367-381, 1990.
26. D. Wagner, J. Foster, E. Brewer, and A. Aiken. A first step toward automated detection of buffer overrum vulnerabilities. In Network Distributed Systems Security Symposium, pages 1-15, Feb. 2000.
27. W. Weimer. The CCured type system and type inference. Technical Report UCB-CS, University of California, Berkeley. http://www.cs.berkeley.edu/~weimer/TheCCuredTypeSystem.ps, 2002.
28. A. Wright and R. Cartwright. A practical soft type system for Scheme. ACM Transactions on Programming Languages and Systems, 1997.