Abstract:Buffer overflow vulnerability is currently one of the most serious software security vulnerabilities. Taking effective methods to detect buffer overflow vulnerabilities is of great significance to improve the robustness and security of software. After analyzing the principle of buffer overflow and various buffer overflow vulnerabilities, as well as comparing static with dynamic detection techniques, this paper presents a static detection method for buffer overflow based on abstract syntax tree, especially for vulnerabilities caused by string accessing of C source code. The proposed method first generates an abstract syntax tree for the source code by using the GCC compiler, and collects the characteristics of vulnerability by analyzing AST nodes. For the nodes associated with the buffer overflow, the method further gives a formal description of that characteristic so as to generate security attributed and constraint rules. By traversing the abstract syntax tree, the proposed method finally determines whether buffer overflow vulnerability exists in the source code. Experiments with 12 C programs were carried out on the Windows platform, and each program has been discovered at least one typical buffer overflow vulnerability. The experimental results highlight the feasibility and effectiveness of the proposed method, especially in the detecting out of range for a pointer, an array, and a structure object, as well as the buffer overflow vulnerability caused by some C library function calls.

Software Vulnerability Detection Method Based on the Lexical and Syntax Analysis

Detecting Buffer-Overflow Vulnerabilities in Smart Grid Devices via Automatic Static Analysis

A Program Vulnerabilities Detection Frame by Static Code Analysis and Model Checking

Static Buffer Overflow Detection for C/C++ Source Code Based on Abstract Syntax Tree

Buffer Overflow Vulnerability Detection based on Format-Matching on Source Level

Automated Detection of Code Vulnerabilities Based on Program Analysis and Model Checking

Buffer overflow detection method based on source code analysis

A Method for Detecting Buffer Overflow Vulnerabilities

Identifying Buffer Overflow Vulnerabilities Based on Binary Code

A Method for Computer Software Security Detection

Research on Software Vulnerability Testing Based on Function-Call

Detection of Buffer Overflow Vulnerabilities in C/C++ with Pattern Based Limited Symbolic Evaluation

Method to detect buffer overflow in C programs

A Novel Method of Software Vulnerability Detection based on Fuzzing Technique

Buffer Overflow Detection in C Code Using Dynamic Symbolic Execution

Survey on Static Software Vulnerability Detection for Source Code

An Android Vulnerability Detection System.

An Empirical Study on Detecting and Fixing Buffer Overflow Bugs

Executable Based Vulnerability Detection

Active Checking Buffer Overflow Vulnerability In Binaries With Symbolic Execution

Dynamic Detection of Buffer-overflow Vulnerabilities in Binary Environment