Abstract:Buffer overflow vulnerability is a kind of serious security defect. Currently there are dynamic and static ap-proaches to detect buffer overflow. The effectiveness of Dynamic tools depends on design of test case, and they often in-troduce execution overhead. Static program analysis techniques have been widely used in buffer overflow detection, which often report a large number of false warnings. Manual validating the results of static analysis is time consuming and er-ror-prone, which severely limits the usefulness of static analysis tools. Symbolic execution is a promising software testing and analysis technology, which systematically explore execution space of test program and generates test cases with high coverage. In this paper we propose a novel approach for automatic buffer overflow warnings validating based on symbolic execution.Our approach is consist of three steps:firstly detect the reachability of statements in static analysis path segment in inter procedural control flow graph and map the static path segment sets to complete path sets which are used to be val-idated;secondly guide the symbolic execution so that we only focus on the execution paths that cover the buffer overflow warnings generated by static program analysis through pruning useless path; finally construct warning path constraints according to buffer overflow vulnerability models at suspicios statements and classify results depend on the output of con-straint solver. Based on the proposed technique we implemented a prototype tool BOVTool and our experimental results on real open source programs show that the percentage of false warnings which do not need to be manually validated is 59.9%on average.

Detection of Buffer Overflow Vulnerabilities in C/C++ with Pattern Based Limited Symbolic Evaluation

Detecting Buffer-Overflow Vulnerabilities in Smart Grid Devices via Automatic Static Analysis

Automatically Validating Static Buffer Overflow Warnings based on Guided Symbolic Execution

An Empirical Study on Detecting and Fixing Buffer Overflow Bugs

Statically Detecting Buffer Overflow in Cross-language Android Applications Written in Java and C/C++

Securing c programs by dynamic type checking

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Buffer Overflow Attacks Analysis and Real-time Detection

Tools to Make C Programs Safe: a Deeper Study

BovdGFE: Buffer Overflow Vulnerability Detection Based on Graph Feature Extraction

HeapTherapy: An Efficient End-to-End Solution against Heap Buffer Overflows

Dynamic and static analyses of integer overflow vulnerabilities

Progress in Research on Buffer Overflow Vulnerability Analysis Technologies

Automatic Buffer Overflow Warning Validation

LibsafeXP: A Practical and Transparent Tool for Run-time Buffer Overflow Preventions

Analysis of Compiler Technology Enhancement ror Buffer Overflow Prevention

S3Library: Automatically Eliminating C/C++ Buffer Overflow using Compatible Safer Libraries

Detecting heap smashing attacks through fault containment wrappers

Testing static analysis tools using exploitable buffer overflows from open source code

Method of integer overflow detection to avoid buffer overflow

To Detect Stack Buffer Overflow with Polymorphic Canaries