Filtering false alarms of buffer overflow analysis using SMT solvers

Information and Software Technology

Volumn 52, Issue 2, 2010, Pages 210-219

  Kim, Youil ^a   Lee, Jooyong ^b   Han, Hwansoo ^c   Choe, Kwang Moo ^a  

^a Korea Advanced Institute of Science and Technology (KAIST)   (South Korea)

^b Sunflower Networking Group   (United States)

^c Sungkyunkwan University   (South Korea)

Author keywords

Buffer overflow; False alarm; Program analysis; SMT solver

Indexed keywords

ABSTRACT INTERPRETATIONS; BUFFER OVERFLOWS; C PROGRAMS; FALSE ALARMS; FILTERING METHOD; NUMBER OF FALSE ALARMS; OPEN-SOURCE PROGRAM; PRECISE ANALYSIS; PROGRAM ANALYSIS; SYMBOLIC EXECUTION; TEST CASE;

ABSTRACTING; BUFFER STORAGE; C (PROGRAMMING LANGUAGE); COMPUTER SOFTWARE; COST REDUCTION; ERRORS; PROGRAM DEBUGGING; PROGRAM INTERPRETERS; STATIC ANALYSIS;

ALARM SYSTEMS;

EID: 70450223307     PISSN: 09505849     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.infsof.2009.10.004     Document Type: Article

References (20)

1. Simplified Wrapper and Interface Generation .
2. Yices: an SMT solver .
3. Cousot P., and Cousot R. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints (1977), POPL pp. 238-252
4. Cousot P., and Halbwachs N. Automatic discovery of linear restraints among variables of a program (1978), POPL pp. 84-96
5. Das M. Unification-based pointer analysis with directional assignments (2000), PLDI pp. 35-46
6. Dor N., Rodeh M., and Sagiv S. Cssv: towards a realistic tool for statically detecting all buffer overflows in c (2003), PLDI pp. 155-167
7. G. Erez, Generating concrete counterexamples for sound abstract interpretation, Master's thesis, Tel-Aviv University, Israel, 2004.
8. Evans D., and Larochelle D. Improving security using extensible lightweight static analysis. IEEE Software 19 1 (2002) 42-51
9. Gulavani B.S., and Rajamani S.K. Counterexample driven refinement for abstract interpretation. Proceedings of the 12th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS'06). LNCS vol. 3920 (2006), Springer 474-488
10. Jung Y., Kim J., Shin J., and Yi K. Taming false alarms from a domain-unaware c analyzer by a bayesian statistical post analysis (2005), SAS pp. 203-217
11. Kim Y., Jeon J., and Han H. Development of cost-effective buffer overrun analyzer. KIISE SIGPL Transactions on Programming Languages 19 2 (2005) 1-9
12. Kremenek T., and Engler D.R. Z-ranking: Using statistical analysis to counter the impact of static analysis approximations (2003), SAS pp. 295-315
13. Miné A. A new numerical abstract domain based on difference-bound matrices. Proc. of the 2d Symp. on Programs as Data Objects (PADO II). Lecture Notes in Computer Science vol. 2053 (2001), Springer, Aarhus, Danemark 155-172. http://www.di.ens.fr/mine/publi/article-mine-padoII.pdf
14. Necula G.C., McPeak S., Rahul S.P., and Weimer W. Cil: intermediate language and tools for analysis and transformation of c programs (2002), CC pp. 213-228
15. Rival X. Understanding the origin of alarms in astrée. Proceedings of the Second International Symposium on Static Analysis (SAS'05). LNCS vol. 3672 (2005), Springer 303-319
16. Venet A., and Brat G.P. Precise and efficient static array bound checking for large embedded c programs (2004), PLDI pp. 231-242
17. Wagner D., Foster J.S., Brewer E.A., and Aiken A. A first step towards automated detection of buffer overrun vulnerabilities (2000), NDSS pp. 3-17
18. Weiser M. Program slicing (1981), ICSE pp. 439-449
19. Xie Y., Chou A., and Engler D.R. Archer: using symbolic, path-sensitive analysis to detect memory access errors (2003), ESEC/SIGSOFT FSE pp. 327-336
20. Zitser M., Lippmann R., and Leek T. Testing static analysis tools using exploitable buffer overflows from open source code. In: Taylor R.N., and Dwyer M.B. (Eds). SIGSOFT FSE (2004), ACM 97-106