Heap memory error-oriented detection method and device

Abstract

The invention discloses a heap memory error-oriented detection method and device, and the method comprises the steps: selecting an input parameter, and carrying out the concolic execution of a tested program; when each execution tracking path in the concolic execution is tracked, generating a corresponding branch constraint for each branch, performing vulnerability detection on each code block related to the heap operation, and generating a vulnerability constraint for the code block with the vulnerability related to the heap; based on the branch constraint and the vulnerability constraint corresponding to each execution tracking path, generating a test case of the execution tracking path; and respectively inputting each test case into the tested program to obtain a verified tested program heap memory error. According to the method, the to-be-analyzed target point can be found as soon as possible while the program coverage rate can be effectively increased, the system performance overhead is minimized on the premise of keeping high consistency with the real running environment of the program, and different types of heap memory errors can be detected.

Description

technical field [0001] The invention relates to software safety testing, in particular to a detection method and device for heap memory errors. Background technique [0002] A memory error is a behavior that occurs when the program is running, when the rewritten content in the memory exceeds the original intention of the programmer (https: / / en.wikipedia.org / wiki / Memory_corruption). Modern programming languages ​​such as C and C++ have powerful memory management and pointer arithmetic features, which also bring hidden dangers of memory safety (L.Szekeres, M.Payer, T.Wei and D.Song, " SoK: Eternal War in Memory," 2013 IEEE Symposium on Security and Privacy, 2013, pp.48-62, doi:10.1109 / SP.2013.13). [0003] Vulnerabilities caused by memory errors are mainly divided into stack-based memory vulnerabilities and heap-based memory vulnerabilities. They can cause very serious dangers such as: system crashes, denial of service, arbitrary code execution and data leakage, etc. Among ...

AI Technical Summary

Problems solved by technology

This simple combination will not only produce some false negatives due to the use of non-uniform memory models in dynamic symbolic execution and heap-based memory vulnerability detection, but also from the perspective of system performance overhead, this simple combination makes every The path execution times of a program doubles, which leads to a waste of a lot of system resources and increases the burden of system overhead.

Images