Practical and effective symbolic analysis for buffer overflow detection

  • Authors:

  • Lian Li;Cristina Cifuentes;Nathan Keynes

  • Affiliations:

  • Oracle, Brisbane, Australia;Oracle, Brisbane, Australia;Oracle, Brisbane, Australia

  • Venue:
  • Proceedings of the eighteenth ACM SIGSOFT international symposium on Foundations of software engineering
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Although buffer overflow detection has been studied for more than 20 years, it is still the most common source of security vulnerabilities in systems code. Different approaches using symbolic analysis have been proposed to detect this vulnerability. However, existing symbolic analysis techniques are either too complex to scale to millions of lines of code (MLOC), or too simple to effectively handle loops and complex program structures. In this paper, we present a novel symbolic analysis algorithm for buffer overflow detection that applies simple rules to solve relevant control and data dependencies. Our approach is path-sensitive and effectively handles loops and complex program structures. Scalability is achieved by using a simple symbolic value representation, filtering out irrelevant dependencies in symbolic value computation and computing symbolic values on demand. Evaluation of our approach shows that it is both practical and effective:the analysis runs over 8.6 MLOC of the OpenSolarisTM Operating system/Networking (ON)codebase in 11 minutes and finds hundreds of buffer overflows with a false positive rate of less than 10%.