Method and device for detecting buffer overflow and code instrumentation method and device

A buffer and code technology, used in computer security devices, instruments, electrical digital data processing, etc., can solve the problems of wasting time and high false alarm rate, and achieve the effect of reducing false alarm rate, improving pertinence and efficiency

Inactive Publication Date: 2010-01-20
SIEMENS CHINA
View PDF0 Cites 20 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

As a result, there will be many unnecessary reports, the false positive rate is high, and a lot of unnecessary time will be wasted when dealing with buffer overflow vulnerabilities based on these reports

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method and device for detecting buffer overflow and code instrumentation method and device
  • Method and device for detecting buffer overflow and code instrumentation method and device
  • Method and device for detecting buffer overflow and code instrumentation method and device

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0064] In the embodiment of the present invention, in order to detect the real loophole of buffer overflow, the program code can be model-tested, that is, the program code can be virtually executed, the program code can be converted into a finite state machine, and the program code in the finite state machine The state space of the system is exhaustively searched to determine whether there is a buffer overflow, and to find out the code execution trace that causes the buffer overflow. Wherein, the code execution trace that causes the buffer overflow refers to a collection of a series of codes of a certain execution path that causes the buffer overflow. However, in this process, when judging whether there is a buffer overflow, it needs to be judged according to the length information of the buffer. However, for these programming language codes that may have buffer overflow vulnerabilities, such as C / C++ codes, there is usually no Provide the length information of the buffer, suc...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention discloses a device and a method for detecting buffer overflow, a code instrumentation device and a code instrumentation method. The detection method comprises the following steps: identifying a code related with a buffer from a program source code, and inserting a buffer length information code corresponding to the code related with the buffer in the program source code; and performing model check on the program code inserted with the buffer length information code, judging whether the buffer overflow exists in the program code according to the buffer length information code, and reporting a code executing track causing the buffer overflow when the buffer overflow exists. The technical scheme disclosed by the invention can detect actually existing buffer overflow.

Description

technical field [0001] The invention relates to the technical field of software safety testing, in particular to a detection method and detection device for buffer overflow loopholes in software, and a code insertion method and insertion device. Background technique [0002] At present, software is increasingly used to process various sensitive and high-value information, such as business information, financial information, etc., which makes software increasingly the target of attackers who attempt to obtain such information. Attackers attempt to exploit security holes in the software to interfere with the running of the software and implement malicious operations on the software. Among them, the buffer overflow vulnerability introduced in the program source code coding stage is the most common security vulnerability, and the buffer overflow may include various types of buffer overflows such as character type, pointer or integer type. Therefore, it is necessary to develop a...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
Patent Type & Authority Applications(China)
IPC IPC(8): G06F21/00G06F21/22G06F21/52
Inventor 唐文胡建钧
Owner SIEMENS CHINA
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap