Flow-insensitive type qualifiers

ACM Transactions on Programming Languages and Systems

Volumn 28, Issue 6, 2006, Pages 1035-1087

  Foster, Jeffrey S ^a,d   Johnson, Robert ^b,e   Kodumal, John ^b,f   Aiken, Alex ^c,g  

^a UNIVERSITY OF MARYLAND   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c STANFORD UNIVERSITY   (United States)

^d University of Maryland   (United States)

^e USA   (United States)

^f Coverity Inc ^*  (United States)

^g Stanford University   (United States)

Author keywords

Const; Constraints; Security; Static analysis; Taint; Type qualifiers; Types

Indexed keywords

FLOW-INSENSITIVE TYPE QUALIFIERS; STATIC ANALYSIS; TYPE QUALIFIERS;

COMPUTER AIDED SOFTWARE ENGINEERING; COMPUTER OPERATING SYSTEMS; VISUALIZATION; WEB BROWSERS;

COMPUTER PROGRAMMING LANGUAGES;

EID: 33845512960     PISSN: 01640925     EISSN: 15584593     Source Type: Journal    
DOI: 10.1145/1186632.1186635     Document Type: Article

References (97)

1. ABADI, M., BANERJEE, A., HEINTZE, N., AND RIECKE, J. G. 1999. A core calculus of dependency. In Proceedings of the 26th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Language (San Antonio, TX). ACM, New York, 147-160.
2. AIKEN, A., FOSTER, J. S., KODUMAL, J., AND TERAUCHI, T. 2003. Checking and inferring local non-aliasing. In Proceedings of the 2003 ACM SIGPLAN Conference on Programming Language Design and Implementation (San Diego, CA). ACM, New York, 129-140.
3. ANSI 1989. Rationale for American National Standard for Information Systems - Programming Language - C. ANSI. Associated with ANSI standard X3.159-1989.
4. ANSI 1999. Programming languages - C. ANSI/ISO/IEC 9899:1999.
5. BAILLEUX, C. 2000. More security problems in bftpd-1.0.12. BugTraq Mailing List, http://www. securityfocus.com/archive/1/149977.
6. BALL, T., NAIK, M., AND RAJAMANI, S. K. 2003. From symptom to cause: Localizing errors in counterexample traces. In Proceedings of the 30th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (New Orleans, LA), ACM, New York, 97-105.
7. BALL, T. AND RAJAMANI, S. K. 2001. Automatically validating temporal safety properties of interfaces. In Proceedings of the 8th International SPIN Workshop on Model Checking of Software. Lecture Notes in Computer Science, vol. 2057, Springer-Verlag, New York, 103-122.
8. BALL, T. AND RAJAMANI, S. K. 2002. The SLAM project: Debugging system software via static analysis. In Proceedings of the 29th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Portland, OR). ACM, New York, 1-3.
9. BISHOP, M. AND DILGER, M. 1996. Checking for race conditions in file accesses. Comput. Syst. 2, 2, 131-152.
10. BROADWELL, P., HARREN, M., AND SASTRY, N. 2003. Scrash: A system for generating secure crash information. In Proceedings of the 12th Usenix Security Symposium (Washington, DC).
11. BUSH, W. R., PINCUS, J. D., AND SIELAFF, D. J. 2000. A static analyzer for finding dynamic programming errors. Softw.-Pract. Exper. 30, 7 (June), 775-802.
12. CERT. 2001. CERT Advisory CA-2001-19 "Code Red" worm exploiting buffer overflow In IIS indexing service DLL. http://www.cert.org/advisories/CA- 2001-19.html.
13. CHANDRA, S. AND REPS, T. W. 1999. Physical type checking for C. In Proceedings of the ACM SIGPLAN/SIGSOFT Workshop on Program Analysis for Software Tools and Engineering (Toulouse, France). ACM, New York, 66-75.
14. CHIN, B., MARKSTRUM, S., AND MILLSTEIN, T. 2005. Semantic type qualifiers. In Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation (Chicago, IL). ACM, New York.
15. COUSOT, P. AND COUSOT, R. 1977. Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proceedings of the 4th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. ACM, New York, 238-252.
16. COWAN, C., BARRINGER, M., BEATTIE, S., AND KROAH-HARTMAN, G. 2001. FormatGuard: Automatic protection from print format string vulnerabilities. In Proceedings of the 10th Usenix Security Symposium (Washington, DC).
17. DAS, M., LERNER, S., AND SEIGLE, M. 2002. ESP: Path-sensitive program verification in polynomial time. In Proceedings of the 2002 ACM SIGPLAN Conference on Programming Language Design and Implementation (Berlin, Germany). ACM, New York, 57-68.
18. DAS, M., LIBLIT, B., FÄHNDRICH, M., AND REHOF, J. 2001. Estimating the impact of scalable pointer analysis on optimization. In Static Analysis, Eighth International Symposium (Paris, France), P. Cousot, Ed. Lecture Notes in Computer Science, vol. 2126. Springer-Verlag, New York.
19. DAVEY, B. A. AND PRIESTLEY, H. A. 1990. Introduction to Lattices and Order. Cambridge University Press.
20. DEKOK, A. 2000. PScan: A limited problem scanner for C source files. http://www.striker. ottawa.on.ca/~aland/pscan.
21. DELINE, R. AND FÄHNDRICH, M. 2001. Enforcing high-level protocols in low-level software. In Proceedings of the 2001 ACM SIGPLAN Conference on Programming Language Design and Implementation (Snowbird, UT). ACM, New York, 59-69.
22. DENNING, D. E. 1976. A lattice model of secure information flow. Commun. ACM 19, 5 (May), 236-243.
23. DETLEFS, D. L., LEINO, K. R. M., NELSON, G., AND SAXE, J. B. 1998. Extended static checking. Tech. Rep. 159, Compaq Systems Research Center. Dec.
24. DUSSART, D., HENGLEIN, F., AND MOSSIN, C. 1995. Polymorphic recursion and subtype qualifications: Polymorphic binding-time analysis in polynomial time. In Static Analysis, Second International Symposium (Glasgow, Scotland), A. Mycroft, Ed. Lecture Notes in Computer Science, vol. 983. Springer-Verlag, New York, 118-135.
25. EIFRIG, J., SMITH, S., AND THIFONOV, V. 1995. Type inference for recursively constrained types and its application to OOP. In Mathematical Foundations of Programming Semantics, Eleventh Annual Conference. Electronic Notes in Theoretical Computer Science, vol. 1. Elsevier-North Holland, Amsterdam, The Netherlands.
26. ENGLER, D., CHELF, B., CHOU, A., AND HALLEM, S. 2000. Checking system rules using system-specific, programmer-written compiler extensions. In Proceedings of the 4th Symposium on Operating System Design and Implementation (San Diego, CA).
27. EVANS, D. 1996. Static detection of dynamic memory errors. Proceedings of the 1996 ACM SIGPLAN Conference on Programming Language Design and Implementation (Philadelphia, PA). ACM, New York, 44-53.
28. FÄHNDRICH, M. 1999. BANE: A library for scalable constraint-based program analysis. Ph.D. thesis, University of California, Berkeley.
29. FÄHNDRICH, M. AND DELINE, R. 2002. Adoption and focus: Practical linear types for imperative programming. Proceedings of the 2002 ACM SIGPLAN Conference on Programming Language Design and Implementation (Berlin, Germany). ACM, New York, 13-24.
30. FÄHNDRICH, M., FOSTER, J. S., Su, Z., AND AIKEN, A. 1998. Partial online cycle elimination in inclusion constraint graphs. In Proceedings of the 1998 ACM SIGPLAN Conference on Programming Language Design and Implementation (Montreal, Ont., Canada). ACM, New York, 85-96.
31. FLANAGAN, C., FLATT, M., KRISHNAMURTHI, S., WEIRICH, S., AND FELLEISEN, M. 1996. Catching bugs in the web of program invariants. Proceedings of the 1996 ACM SIGPLAN Conference on Programming Language Design and Implementation (Philadelphia, PA). ACM, New York, 23-32.
32. FLANAGAN, C. AND LEINO, K. R. M. 2001. Houdini, an annotation assitant for ESC/Java. In FME 2001: Formal Methods for Increasing Software Productivity, International Symposium of Formal Methods (Berlin, Germany) J. N. Oliverira and P. Zave, Eds. Lecture Notes in Computer Science, vol. 2021. Springer-Verlag, New York, 500-517.
33. FLANAGAN, C., LEINO, K. R. M., LILLIBRIDGE, M., NELSON, G., SAXE, J. B., AND STATA, R. 2002. Extended static checking for Java. Proceedings of the 2002 ACM SIGPLAN Conference on Programming Language Design and Implementation (Berlin, Germany). ACM, New York, 234-245.
34. FOSTER, J. S. 2002. Type qualifiers: Lightweight specifications to improve software quality. Ph.D. dissertation, University of California, Berkeley, Berkeley, CA.
35. FOSTER, J. S., FÄHNDRICH, M., AND AIKEN, A. 1999. A theory of type qualifiers. In Proceedings of the 1999 ACM SIGPLAN Conference on Programming Language Design and Implementation (Atlanta, GA). ACM, New York, 192-203.
36. FOSTER, J. S., TERAUCHI, T., AND AIKEN, A. 2002. Flow-sensitive type qualifiers. In Proceedings of the 2002 ACM SIGPLAN Conference on Programming Language Design and Implementation (Berlin, Germany). ACM, New York, 1-12.
37. FRASUNEK, P. 2001a. format string vulnerability in mars_nwe 0.99pl19. http://online.sacurityfocus.com/archive/1/158959.
38. FRASUNEK, P. 2001b. ports/24733: mars_nwe remote format string vulnerability, http://groups.google.com/groups?q=mars_nwe+vulnerability&hl= en&lr=&ie=UTF-8&oe=UTF-8&selm= 9566si%24gpv%241%40FreeBSD.csie. NCTU.edu.tw&rnum=1.
39. FREEMAN, T. AND PFENNING, F. 1991. Refinement types for ML. In Proceedings of the 1991 ACM SIGPLAN Conference on Programming Language Design and Implementation (Toronto, Ont., Canada). ACM, New York, 268-277.
40. GATES, B. 2002. Trustworthy computing. Microsoft internal memo. Available at http://www. theregister.co.uk/content/4/23715.html.
41. GAY, D. AND AIKEN, A. 2001. Language support for regions. In Proceedings of the 2001 ACM SIGPLAN Conference on Programming Language Design and Implementation (Snowbird, UT). ACM, New York, 70-80.
42. GIFFORD, D. K., JOUVELOT, P., LUCASSEN, J. M., AND SHELDON, M. A. 1987. FX-87 Reference Manual. Tech. Rep. MIT/LCS/TR-407, MIT Laboratory for Computer Science. Sept.
43. GREENFIELDBOYCE, D. AND FOSTER, J. S. 2004. Visualizing type qualifier inference with eclipse. In Proceedings of the Workshop on Eclipse Technology eXchange (Vancouver, B.C., Canada). ACM, New York.
44. GROSSMAN, D., MORRISETT, G., JIM, T., HICKS, M., WANG, Y., AND CHENEY, J. 2002. Region-based memory management in cyclone. Proceedings of the 2002 ACM SIGPLAN Conference on Programming Language Design and Implementation (Berlin, Germany). ACM, New York, 282-293.
45. GROSSMAN, D., MORRISETT, G., WANG, Y., JIM, T., HICKS, M., AND CHENEY, J. 2001. Cyclone user's manual. Tech. Rep. 2001-1855, Department of Computer Science, Cornell University. Nov.
46. HALLEM, S., CHELF, B., XIE, Y., AND ENGLER, D. 2002. A system and language for building system-specific, static analyses. In Proceedings of the 2002 ACM SIGPLAN Conference on Programming Language Design and Implementation (Berlin, Germany). ACM, New York, 69-82.
47. HARRELSON, C. 2001. Program analysis mode. http://www.cs.berkaley.edu/ ~chrishtr/pain.
48. HEINTZE, N. AND TARDIEU, O. 2001. Ultra-fast aliasing analysis using CLA: A million lines of C code in a second. In Proceedings of the 2001 ACM SIGPLAN Conference on Programming Language Design and Implementation (Snowbird, UT). ACM, New York, 254-263.
49. HENGLEIN, F. 1991. Efficient type inference for higher-order binding-time analysis. In FPCA '91 Conference on Functional Programming Languages and Computer Architecture (Cambridge, MA), J. Hughes, Ed. Lecture Notes in Computer Science, vol. 523. Springer-Verlag, New York, 448-472.
50. HENGLEIN, F. 1993. Type inference with polymorphic recursion. ACM Trans. Prog. Lang. Syst. 15, 2 (Apr.), 253-289.
51. HENRION, M. 2000. MUH IRC bouncer remote vulnerability. FreeBSD-SA-00:57. http://www. securityfocus.com/advisories/2741.
52. HENZINGER, T. A., JHALA, R., MAJUMDAR, R., AND SUTRE, G. 2002. Lazy abstraction. In Proceedings of the 29th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Portland, OR). ACM, New York, 58-70.
53. HORWITZ, S., REPS, T., AND SAGIV, M. 1995. Demand interprocedural dataflow analysis. In Proceedings of the 3rd Symposium on the Foundations of Software Engineering (Washington, DC), 104-115.
54. HUUSKONEN, J. 2000a. Possibility for format char errors in syslog call. https://bugzilla.radhat. com/bugzilla/show_bug.cgi?id=17349.
55. HUUSKONEN, J. 2000b. Some possible format string errors. Linux security audit project mailing list. http://www2.merton.ox.ac.uk/~security/security- audit-200009/0118.html.
56. HUUSKONEN, J. 2000c. syslog(prio, buf) in mars_nwe. Linux security audit project mailing list, http://www2.marton.ox.ac.uk/~sacurity/security-audit- 200009/0136.html.
57. JOHNSON, R. AND WAGNER, D. 2004. Finding user/kernel bugs with type inference. In Proceedings of the 13th Usenix Security Symposium (San Diego, CA).
58. KLAELUND, N. AND SCHWARTZBACH, M. I. 1993. Graph types. In Proceedings of the 20th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Charleston, SC). ACM, New York, 196-205.
59. LAROCHELLE, D. AND EVANS, D. 2001. Statically detecting likely buffer overflow vulnerabilities. In Proceedings of the 10th Usenix Security Symposium (Washington, DC).
60. LEINO, K. R. M. AND NELSON, G. 1998. An extended static checker for modula-3. In Compiler Construction, 7th International Conference (Lisbon, Portugal). K. Koskimies, Ed. Lecture Notes in Computer Science, vol. 1383. Springer-Verlag, New York, 302-305.
61. LIBLIT, B. AND AIKEN, A. 2000. Type systems for distributed data structures. In Proceedings of the 27th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Boston, MA). ACM, New York, 199-213.
62. LUCASSEN, J. M. AND GIEFORD, D. K. 1988. Polymorphic effect systems. In Proceedings of the 15th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (San Diego, CA). ACM, New York, 47-57.
63. MANDELBAUM, Y., WALKER, D., AND HARPER, R. 2003. An effective theory of type refinements. In Proceedings of the 8th ACM SIGPLAN International Conference on Functional Programming (Uppsala, Sweden). ACM, New York, 213-225.
64. MARS CLIMATE ORBITER MISHAP INVESTIGATION BOARD. 1999. Phase I Report, ftp://ftp.hq.nasa.gov/pub/pao/raports/1999/MCO_report.pdf.
65. MILNER, R. 1978. A theory of type polymorphism in programming. J. Comput. Syst. Sci. 17, 348-375.
66. MITCHELL, J. C. 1991. Type inference with simple subtypes. J. Funct. Prog. 1, 3 (July), 245-285.
67. MØLLER, A. AND SCHWARTZBACH, M. I. 2001. The pointer assertion logic engine. In Proceedings of the 2001 ACM SIGPLAN Conference on Programming Language Design and Implementation (Snowbird, UT). ACM, New York, 221-231.
68. MOSSIN, C. 1996. Flow analysis of typed higher-order programs. Ph.D. dissertation. DIKU, Department of Computer Science, University of Copenhagen.
69. NECULA, G., McPEAK, S., AND WEIMER, W 2002. CCured: Type-safe retrofitting of legacy code. In Proceedings of the 29th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Portland, OR). ACM, New York, 128-139.
70. NEWSHAM, T. 2000. Format string attacks, http://online.securityfocus.com/ guest/3342.
71. NIST. 2002. The economic impacts of inadequate infrastructure for software testing. NIST Planning Report 02-3. http://www.nist.gov/diractor/prog- ofc/report02-3.pdf.
72. ODERSKY, M., SULZMANN, M., AND WEHR, M. 1997. Type inference with constrained types. In Proceedings of the 4th International Workshop on Foundations of Object-Oriented Languages, B. Pierce, Ed.
73. ØRBÆK, P. AND PALSBERG, J. 1997. Trust in the λ-calculus. J. Funct. Prog. 3, 2, 75-85.
74. PIERCE, B. C. 2002. Types and Programming Languages. MIT Press, Cambridge, MA.
75. PITAC. 1999. President's Information Technology Advisory Committee Report to the President, http://www.ccic.gov/ac/report.
76. PRATIKAKIS, P., SPACCO, J., AND HICKS, M. 2004. Transparent proxies for Java futures. In Proceedings of the 19th Annual Conference on Object-Oriented Programming Systems, Languages, and Applications. 206-223.
77. PRATT, V. AND TIURYN, J. 1996. Satisfiability of inequalities in a poset. Funda. Inf. 28, 1-2, 165-182.
78. REHOF, J. AND FÄHNDRICH, M. 2001. Type-based flow analysis: From polymorphic subtyping to CFL-reachability. In Proceedings of the 28th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (London, United Kingdom). ACM, New York, 54-66.
79. REHOF, J. AND MOGENSEN, T. Æ. 1996. Tractable constraints in finite semilattices. In Static Analysis, Third International Symposium (Aachen, Germany). R. Cousot and D. A. Schmidt, Eds. Lecture Notes in Computer Science, vol. 1145. Springer-Verlag, New York, 285-300.
80. REPS, T., HORWITZ, S., AND SAGIV, M. 1995. Precise interprocedural dataflow analysis via graph reachability. In Proceedings of the 22nd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (San Francisco, CA). ACM, New York, 49-61.
81. ROBBINS, T. J. 2001. Libformat-Protection against format string attacks. http://www. wiretapped.net/~fyre/softwara/libformat.html.
82. SAGIV, M., REPS, T., AND WILHELM, R. 1999. Parametric shape analysis via 3-valued logic. In Proceedings of the 26th Annual ACM SIGPLAN-SIGACT Symposium, on Principles of Programming Languages (San Antonio, TX). ACM, New York, 105-118.
83. SAVOLA, P. 2000. Very probable remote root vulnerability in cfengine. BugTraq mailing list, http://www.securityfocus.com/archive/1/136751.
84. SHANKAE, U., TALWAR, K., POSTER, J. S., AND WAGNER, D. 2001. Detecting format string vulnerabilities with type qualifiers. In Proceedings of the 10th Usenix Security Symposium (Washington, DC).
85. SKALKA, C. AND SMITH, S. 2000. Static enforcement of security with types. In Proceedings of the 5th ACM SIGPLAN International Conference on Functional Programming (Montreal, Que., Canada) ACM, New York, 34-45.
86. SMITH, G. AND VOLPANO, D. 1998. Secure information flow in a multi-threaded imperative language. In Proceedings of the 25th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (San Diego, CA). ACM, New York, 355-364.
87. SOLBERG, K. L. 1995. Annotated type systems for program analysis. Ph.D. dissertation. Aarhus University, Denmark, Computer Science Department.
88. STROUSTRUP, B. 2005. C++ style and technique FAQ. http://www.research. att.com/~bs/bs_ faq2.html#constplacemant.
89. VIEGA, J., BLOCK, J., KOHNO, T., AND McGRAW, G. 2000. ITS4: A static vulnerability scanner for C and C++ Code. In Proceedings of the 16th Annual Computer Security Applications Conference. http://www.acsac.org.
90. VOLPANO, D. AND SMITH, G. 1997. A type-based approach to program security. In Theory and Practice of Software Development, 7th International Joint Conference (Lille, France). M. Bidoit and M. Dauchet, Eds. Lecture Notes in Computer Science, vol. 1214. Springer-Verlag, New York, 607-621.
91. WALL, L., CHRISTIANSEN, T., AND ORWANT, J. 2000. Programming Perl, 3rd Edition ed. O'Reilly & Associates.
92. WRIGHT, A. K. 1995. Simple imperative polymorphism. In LISP and Symbolic Computation 8, Vol. 4. 343-356.
93. WRIGHT, A. K. AND FELLEISEN, M. 1994. A syntactic approach to type soundness. Inf. Comput. 115, 1, 38-94.
94. YANG, J., KREMENEK, T., XIE, Y., AND ENGLER, D. 2003. MECA: An extensible, expressive system and language for statically checking security properties. In Proceedings of the 10th ACM Conference on Computer and Communication Security (Washington, DC). ACM, New York, 321-334.
95. YELICK, K., SEMENZATO, L., PIKE, G., MIYAMOTO, C., LIBLIT, B., KRISHNAMUHTHY, A., HILFINGER, P., GRAHAM, S., GAY, D., COLELLA, P., AND AIKEN, A. 1998. Titanium: A high-performance Java dialect. In Proceedings of the ACM 1998 Workshop on Java for High-Performance Network Computing. ACM, New York
96. YONG, S. H., HORWITZ, S., AND REPS, T. 1999. Pointer analysis for programs with structures and casting. In Proceedings of the 1999 ACM SIGPLAN Conference on Programming Language Design and Implementation (Atlanta, CA). ACM, New York, 91-103.
97. ZHANG, X., EDWARDS, A., AND JAEGER, T. 2002. Using CQUAL for static analysis of authorization hook placement. In Proceedings of the 11th Usenix Security Symposium (San Francisco, CA).