摘要
本文提出一种流敏感的静态检测算法。通过需求驱动的控制流分析和数据流分析,建立内存访问语句和函数调用语句发生溢出的线性约束,从而将缓冲区溢出的检测问题转换为线性约束求解问题。我们实现了该算法的原型,实验表明,该原型可以准确而高效地发现实际程序中的缓冲区溢出漏洞。
This paper proposes a flow-sensitive algorithm to detect buffer overruns statically. Using control flow and data flow analysis with demand-driven techniques, it builds the linear constraints of statements that access memory or call a function, and transforms the problem of buffer overrun detection into the problem of linear constraint resolution. Based on the algorithm, we implement a prototype. Experimental results show the prototype is accurate and efficient in identifying vulnerabilities.
出处
《计算机工程与科学》
CSCD
2007年第1期86-87,100,共3页
Computer Engineering & Science
基金
国家863计划资助项目(2002AA1Z2101)
关键词
安全分析
缓冲区溢出
静态检测算法
需求驱动
流敏感
analysis for security
buffer overrun
static detection algorithm
demand-driven
flow-sensitive
