Detecting buffer overflow via automatic test input data generation

  • Authors:

  • C. Del Grosso;G. Antoniol;E. Merlo;P. Galinier

  • Affiliations:

  • Department of Engineering, RCOST-Research Centre on Software Technology, University of Sannio, Palazzo ex Poste, Via Traiano, 82100 Benevento, Italy;Département de Génie Informatique, ícole Polytechnique de Montréal, 2500, chemin de Polytechnique, Montréal, Qué., Canada H3T 1J4;Département de Génie Informatique, ícole Polytechnique de Montréal, 2500, chemin de Polytechnique, Montréal, Qué., Canada H3T 1J4;Département de Génie Informatique, ícole Polytechnique de Montréal, 2500, chemin de Polytechnique, Montréal, Qué., Canada H3T 1J4

  • Venue:
  • Computers and Operations Research
  • Year:
  • 2008

Quantified Score

Hi-index 0.01

Visualization

Abstract

Buffer overflows cause serious problems in various categories of software systems. In critical systems, such as health-care, nuclear or aerospace software applications, a buffer overflow may cause severe threats to humans or severe economic losses. If they occur in network or security applications, they can be exploited to gain administrator privileges, perform system attacks, access unauthorized data, or misuse the system. This paper proposes a combination of genetic algorithms, linear programming, evolutionary testing, and static and dynamic information to detect buffer overflows. The newly proposed test input generation process avoids the need for human intervention to define and tune genetic algorithm weights and therefore it becomes completely automated. The process that guides the genetic search towards the detection of buffer overflow relies on a fitness function that takes into account static and dynamic information. Reported results of our case studies, consisting of two sets of open-source programs show that the new process and fitness function outperform previously published approaches.