Out of bound arithmetic advancing a pointer beyond the buffer 's bounds – Out of bound update - writing to an address beyond the buffer 's bounds The Airbus code itself is confidential so we will use open source examples. Examples to buffer overrun: Such overruns are common, FUZZ study has found that in 9 different UNIX systems, of hangs or crashes are caused by overruns. Another study, CERT, has shown direct connection between buffer overruns and software attack (50% of the attacks are based on buffer overflows). We want an algorithm that is efficient, and fully supports C syntax. We also want it to produce a few as possible false alarms that are very expensive in critical applications such as aviation. A complicated example: In this example there are two possible overflows:TODO In statement strcpy(&temp[i],"(long)") if 7 + offset (cp) BUFSIZ In command strcpy(&temp[i+6],cp) if offset(cp)+7 +len(cp) BUFSIZ Verifying absence of buffer overflow is non-trivial, the conditions may become complex. In the next example the conditions for the absence of buffer overflow are included: These conditions are built in a bottom up manner. They use the following expressions: string(src) indicates that src is null terminated. – alloc(dst) returns the size of buffer (or sub-buffer) pointed by dst. – strlen(src) - returns the length of string (or sub-string) pointed by src. The CSSV approach Challenges Challenge Selected Method Details Complex linear relationships Use Polyhedra[CH78] Linear inequalities Pointer arithmetic Pointer analysis Point-To Loops Widening Might cause false-alarms Procedures Procedure contracts In/out conditions per procedure
Out of bound arithmetic – advancing a pointer beyond the buffer 's bounds Out of bound update - writing to an address beyond the buffer 's bounds The Airbus code itself is confidential so we will use open source examples. Examples to buffer overrun: Such overruns are common, FUZZ study has found that in 9 different UNIX systems, of hangs or crashes are caused by overruns. Another study, CERT, has shown direct connection between buffer overruns and software attack (50% of the attacks are based on buffer overflows). We want an algorithm that is efficient, and fully supports C syntax. We also want it to produce a few as possible false alarms that are very expensive in critical applications such as aviation. A complicated example: In this example there are two possible overflows:TODO In statement strcpy(&temp[i],"(long)") if 7 + offset (cp) BUFSIZ In command strcpy(&temp[i+6],cp) if offset(cp)+7 +len(cp) BUFSIZ Verifying absence of buffer overflow is non-trivial, the conditions may become complex. In the next example the conditions for the absence of buffer overflow are included: These conditions are built in a bottom up manner. They use the following expressions: string(src) – indicates that src is null terminated. alloc(dst) – returns the size of buffer (or sub-buffer) pointed by dst. strlen(src) - returns the length of string (or sub-string) pointed by src. The CSSV approach Challenges Challenge Selected Method Details Complex linear relationships Use Polyhedra[CH78] Linear inequalities Pointer arithmetic Pointer analysis Point-To Loops Widening Might cause false-alarms Procedures Procedure contracts In/out conditions per procedure
cssv_scribe.docx