Paper: Testing C Programs for Buffer Overflow Vulnerabilities

Citation

• E. Haugh and M. Bishop, “Testing C Programs for Buffer Overflow Vulnerabilities,” Proceedings of the 2003 Network and Distributed System Security Symposium pp. 123–130 (Feb. 2003).

Paper

• PDF
• PS

Bibliographic Information

• BibTeX
• EndNote

Abstract

Security vulnerabilities often result from buffer overflows. A testing technique that instruments programs with code that keeps track of memory buffers, and checks arguments to functions to determine if they satisfy certain conditions, warns when a buffer overflow may occur. It does so when executed with “normal” test data as opposed to test data designed to trigger buffer overflows. A tool using this method was developed and evaluated by testing three widely used, open source software packages. This evaluation shows that the tool is useful for finding buffer overflow flaws, that it has a low false positive rate, and compares well with other techniques.

Copyright Notice

©2003 Internet Society. This is the author’s version of the work. It is posted here for your personal use. Not for redistribution. The definitive version was published in Proceedings of the 2003 Network and Distributed System Security Symposiu, Feb. 2003.