Securing c programs by dynamic type checking

Authors:
Haibin Shen;Jimin Wang;Lingdi Ping;Kang Sun
Affiliations:
College of Computer Science and Technology, Zhejiang University, China;College of Computer Science and Technology, Zhejiang University, China;College of Computer Science and Technology, Zhejiang University, China;College of Computer Science and Technology, Zhejiang University, China
Venue:
ISPEC'06 Proceedings of the Second international conference on Information Security Practice and Experience
Year:
2006

Citing 5
Cited 0

Physical type checking for C

Proceedings of the 1999 ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
Coping with type casts in C

ESEC/FSE-7 Proceedings of the 7th European software engineering conference held jointly with the 7th ACM SIGSOFT international symposium on Foundations of software engineering
Debugging via Run-Time Type Checking

FASE '01 Proceedings of the 4th International Conference on Fundamental Approaches to Software Engineering
Detecting format string vulnerabilities with type qualifiers

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Run-time type checking for binary programs

CC'03 Proceedings of the 12th international conference on Compiler construction

Quantified Score

Hi-index	0.00

Visualization

Abstract

Flexible features of C can be misused and result in potential vulnerabilities which are hard to detect by performing only static checking. Existing tools either give up run-time type checking or employ a type system whose granularity is too coarse (it does not differentiate between pointer types) so that many errors may go undetected. This paper presents a dynamic checking approach to conquer them. A type system that is based on the physical layout of data types and has the proper granularity has been employed. Rules for propagating dynamic types and checking for compatibility of types during execution of the target program are also set up. Then a model of dynamic type checking on this type system to capture run-time type errors is built. Experimental results show that it can catch most errors, including those may become system vulnerabilities and the overhead is moderate.