Using Type Qualifiers to Analyze Untrusted Integers and Detecting Security Flaws in C Programs

Citation

• E. Ceesay, J. Zhou, M. Gertz, K. Levitt, and M. Bishop, “Using Type Qualifiers to Analyze Untrusted Integers and Detecting Security Flaws in C Programs,” Proceedings of the GI/IEEE SIG SIDAR Conference on Detection and Intrusions and Malware and Vulnerability Assessment pp. 1–16 (July 2006).

Paper

• PDF
• PS

Bibliographic Information

• DOI: 10.1007/11790754_1
• BibTeX
• EndNote

Abstract

Incomplete or improper input validation is one of the major sources of security bugs in programs. While traditional approaches often focus on detecting string related buffer overflow vulnerabilities, we present an approach to automatically detect potential integer misuse, such as integer overflows in C programs. Our tool is based on CQual, a static analysis tool using type theory. Our techniques have been implemented and tested on several widely used open source applications. Using the tool, we found known and unknown integer related vulnerabilities in these applications.

Copyright Notice

©2006 Springer-Verlag Berlin Heidelberg.
This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author’s copyright. In most cases, these works may not be reposted without the explicit permission of the copyright holder.
The definitive version was published in the Proceedings of the GI/IEEE SIG SIDAR Conference on Detection and Intrusions and Malware and Vulnerability AssessmentSep. 2005.