GCC abstract syntax tree-based buffer overflow vulnerability detection method

Abstract

The invention relates to a buffer overflow vulnerability detection method, in particular to a GCC abstract syntax tree-based buffer overflow vulnerability detection method, and belongs to the technical field of information security. The method comprises the following steps of: operating a source program by using a GCC compiler to generate an abstract syntax tree; eliminating all information not related to analysis data streams and control streams in the text of the abstract syntax tree and maintaining the integrity of useful information; and using the useful information in program analysis, and monitoring related nodes on the abstract syntax tree to fulfill the aims of analyzing and detecting the buffer overflow vulnerability. Compared with the traditional analysis method which does not eliminate redundancy, the method has better practicability and higher efficiency and precision.

Description

Technical field [0001] The invention relates to a method for detecting a buffer overflow vulnerability, in particular to a method for detecting a buffer overflow vulnerability based on a GCC abstract syntax tree, and belongs to the technical field of information security. Background technique [0002] With the rapid development of computer technology, the degree of informatization of human society is getting higher and higher, and the political, economic, military, cultural, and other fields of the entire society rely more and more on computer information systems. Under this circumstance, the security of computer systems has attracted more and more attention. However, the writing of large-scale software and systems requires many programmers to complete the work. They divide a software or system into several sections, divide the work to write, then summarize, test; finally patch and release, so there are almost security vulnerabilities in the software. It is inevitable. Software...

AI Technical Summary

Problems solved by technology

[0013] The disadvantages of this method are: ① directly analyze and detect the abstract syntax tree AST generated by the GCC compiler, and the abstract syntax tree text generated by GCC contains many detailed information that is helpful for compilation, such as generated by the "#include" command Functions and structures that are not used in the source program, as well as some internal functions, type declarations, error messages, constants, etc. generated during the compilation process, these information are not conducive to code analysis

For complex source programs, the detection efficiency of these methods will be greatly reduced

②In the second step, the attribute information of the buffer is represented by a pair of integers, which is not accurate enough and will lead to inaccurate judgment results

But its obvious shortcoming is the dependence of dynamic detection technology on input. Only when the specific input is the program execution to the dangerous point, the vulnerability will be discovered. Therefore, the positioning is inaccurate and the false negative rate is high.