Show simple item record

Sound Input Filter Generation for Integer Overflow Errors

dc.date.accessioned2013-08-12T02:30:08Z
dc.date.accessioned2018-11-26T22:27:02Z
dc.date.available2013-08-12T02:30:08Z
dc.date.available2018-11-26T22:27:02Z
dc.date.issued2013-08-06
dc.identifier.urihttp://hdl.handle.net/1721.1/79827
dc.identifier.urihttp://repository.aust.edu.ng/xmlui/handle/1721.1/79827
dc.description.abstractWe present a system, SIFT, for generating input filters that nullify integer overflow errors associated with critical program sites such as memory allocation or block copy sites. SIFT uses a static program analysis to generate filters that discard inputs that may trigger integer overflow errors in the computations of the sizes of allocated memory blocks or the number of copied bytes in block copy operations. The generated filters are sound if an input passes the filter, it will not trigger an integer overflow error for any analyzed site. Our results show that SIFT successfully analyzes (and therefore generates sound input filters for) 52 out of 58 memory allocation and block memory copy sites in analyzed input processing modules from five applications (VLC, Dillo, Swfdec, Swftools, and GIMP). These nullified errors include six known integer overflow vulnerabilities. Our results also show that applying these filters to 62895 real-world inputs produces no false positives. The analysis and filter generation times are all less than a second.en_US
dc.format.extent20 p.en_US
dc.subjectStatic Analysisen_US
dc.subjectInteger Overflowen_US
dc.subjectFilter Generationen_US
dc.titleSound Input Filter Generation for Integer Overflow Errorsen_US


Files in this item

FilesSizeFormatView
MIT-CSAIL-TR-2013-018.pdf478.4Kbapplication/pdfView/Open

This item appears in the following Collection(s)

Show simple item record