Abstract:Buffer overflow is one of the most common types of software vulnerabilities. Various static analysis and dynamic testing techniques have been proposed to detect buffer overflow vulnerabilities. With automatic tool support, static buffer overflow detection technique has been widely used in academia and industry. However, it tends to report too many false positives fundamentally due to the lack of software execution information. Currently, static warnings can only be validated by manual inspection, which significantly limits the practicality of the static analysis. In this paper, we present BovInspector, a tool framework for automatic static buffer overflow warnings inspection and validated bugs repair. Given the program source code and static buffer overflow vulnerability warnings, BovInspector first performs warning reachability analysis. Then, BovInspector executes the source code symbolically under the guidance of reachable warnings. Each reachable warning is validated and classified by checking whether all the path conditions and the buffer overflow constraints can be satisfied simultaneously. For each validated true warning, BovInspector fix it with three predefined strategies. BovInspector is complementary to prior static buffer overflow discovery schemes. Experimental results on real open source programs show that BovInspector can automatically inspect on average of 74.9% of total warnings, and false warnings account for about 25% to 100% (on average of 59.9%) of the total inspected warnings. In addition, the automatically generated patches fix all target vulnerabilities. Further information regarding the implementation and experimental results of BovInspector is available at http://bovinspectortool.github.io/project/. And a short video for demonstrating the capabilities of BovInspector is now available at https://youtu.be/IMdcksROJDg.

Automatically Validating Static Buffer Overflow Warnings based on Guided Symbolic Execution

Automatic Buffer Overflow Warning Validation

BovInspector: Automatic Inspection and Repair of Buffer Overflow Vulnerabilities.

Detecting Buffer-Overflow Vulnerabilities in Smart Grid Devices via Automatic Static Analysis

Buffer Overflow Detection in C Code Using Dynamic Symbolic Execution

Active Checking Buffer Overflow Vulnerability In Binaries With Symbolic Execution

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Static Buffer Overflow Detection for C/C++ Source Code Based on Abstract Syntax Tree

A Method for Detecting Buffer Overflow Vulnerabilities

Full-automatic Detection of Memory Safety Violations for C Programs

Automatic Exploit Generation for Buffer Overflow Vulnerabilities

Detection of Buffer Overflow Vulnerabilities in C/C++ with Pattern Based Limited Symbolic Evaluation

An Empirical Study on Detecting and Fixing Buffer Overflow Bugs

BofAEG: Automated Stack Buffer Overflow Vulnerability Detection and Exploit Generation Based on Symbolic Execution and Dynamic Analysis

Statically-Guided Fork-based Symbolic Execution for Vulnerability Detection.

Identifying Buffer Overflow Vulnerabilities Based on Binary Code

Patch-Related Vulnerability Detection Based on Symbolic Execution

Testing static analysis tools using exploitable buffer overflows from open source code

Simplifying Buffer Overflow Detection Using Site-Safe Expressions

Automated Detection of Code Vulnerabilities Based on Program Analysis and Model Checking

Validating Static Warnings via Testing Code Fragments