Flow-insensitive static analysis for detecting integer anomalies in programs

Proceedings of the IASTED International Conference on Software Engineering, SE 2007

Volumn , Issue , 2007, Pages 334-340

  Sarkar, Dipanwita ^a   Jagannathan, Muthu ^a   Thiagarajan, Jay ^a   Venkatapathy, Ramanathan ^a  

^a MICROSOFT   (United States)

Author keywords

Buffer overrun; Integer overflow; Integer underflow; Security; Static analysis

Indexed keywords

DIGITAL SIGNAL PROCESSING; SOFTWARE ENGINEERING; SPONTANEOUS EMISSION; STATIC ANALYSIS;

ANALYSIS ALGORITHMS; ANAMOLIES; ARITHMETIC OPERATIONS; BUFFER OVERRUN; BUFFER OVERRUNS; BUFFER SIZES; INTEGER OVERFLOW; INTEGER UNDERFLOW; INTEGER VALUES; INTEGER VARIABLES; MEMORY ALLOCATIONS; MICROSOFT; NOISE RATES; SECURITY; UNDER FLOWS;

INTEGER PROGRAMMING;

EID: 56249126470     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (23)

1. Michael Howard and David LeBlanc. Writing Secure Code, Second Edition, 2002.
2. John Viega. Secure Programming Cookbook for C and C++, First Edition, 2003.
3. John Viega. Building Secure Software, First Edition, 2001.
4. CA-2001-35 CERT Advisory.
5. CA-2003-10 CERT Advisory.
6. MS04-025 Microsoft Security Bulletin.
7. David Evans, John Guttag, James Horning, and Yang Meng Tan. LCLint: A tool for using specifications to check code. In Proceedings of the ACM SIGSOFT '94 Symposium on the Foundations of Software Engineering, pages 87-96, 1994.
8. Brian Hackett, Manuvir Das, Daniel Wang, and Zhe Yang. Modular checking for buffer overflows in the large. In ICSE, 2006.
9. K. Ashcraft and D. Engler. Using programmerwritten compiler extensions to catch security holes, May 2002. In IEEE Symposium on Security and Privacy, Oakland, California.
10. B. Chess. Improving computer security using extended static checking. In IEEE Symposium on Security and Privacy,, 2002.
11. David Evans and David Larochelle. Improving security using extensible lightweight static analysis. IEEE Software, 19(1):42-51, /2002.
12. Junfeng Yang, Ted Kremenek, Yichen Xie, and Dawson Engler. MECA: an extensible, expressive system and language for statically checking security properties. In 10th ACM Conference on Computer and Communications Security, 2003.
13. Jim Larus et.al. Righting software. In IEEE SOFTWARE published by IEEE Computer Society, 2004.
14. William R. Bush, Jonathan D. Pincus, and David J. Sielaff. A static analyzer for finding dynamic programming errors. Software - Practice and Experience, 30(7):775-802, 2000.
15. Thomas Ball, Mayur Naik, and Sriram K. Rajamani. From symptom to cause: localizing errors in counterexample traces. SIGPLAN Not., 38(1):97-105, 2003.
16. Thomas Ball and Sriram K. Rajamani. Automatically validating temporal safety properties of interfaces. In SPIN '01: Proceedings of the 8th international SPIN workshop on Model checking of software, pages 103-122, New York, NY, USA, 2001. Springer-Verlag New York, Inc.
17. Manuvir Das, Sorin Lerner, and Mark Seigle. ESP: path-sensitive program verification in polynomial time. In PLDI '02: Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation, pages 57-68, New York, NY, USA, 2002. ACM Press.
18. Patrick Cousot and Nicholas Halbwachs. Automatic discovery of linear restraints between variables of a program. In 5th Annual ACM Symposium on Principle of Programming Languages, 1978.
19. Zhendong Su and David Wagner. A class of polynomially solvable range constraints for interval analysis without widenings and narrowings. In TACAS, 2004.
20. David Wagner, Jeffrey S. Foster, Eric A. Brewer, and Alexander Aiken. A first step towards automated detection of buffer overrun vulnerabilities. In Network and Distributed System Security Symposium, 2000.
21. Arnaud Venet and Guillaume Brat. Precise and efficient static array bound checking for large embedded c programs. In PLDI, 2004.
22. Vinod Ganapathy et.al. Buffer overrun detection using linear programming and static analysis. In CCS03, 2003.
23. Wei-Ngan Chin and Siau-Cheng Khoo. Calculating sized types. In Partial Evaluation and Semantic-Based Program Manipulation, pages 62-72, 2000.