Buffer Overflow Detection and Patching via Call Return Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Buffer overflow in programs can cause improper operation and security vulnerabilities, as excess data overwrites return addresses in the memory stack, leading to crashes and potential security compromises.
Innovation Solution
A method involving an overflow detection module (ODM) and a patch module that determines the minimum and maximum input lengths causing buffer overflow, collects call/return pairs, identifies the function responsible, and inserts a patch with bounds to prevent overflow by monitoring and generating fuzzed inputs to assess function calls, thereby preventing buffer overflows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If buffer overflow detection and patching is implemented, then security and reliability are improved, but device complexity increases
Solution Approach 1:
The system performs self-testing by automatically generating fuzzed inputs, detecting buffer overflows, and applying patches without external intervention. The overflow detection module tests the program itself to identify vulnerable functions and the patch module automatically generates and applies fixes, enabling the system to maintain its own reliability.
Solution Approach 2:
The system performs preliminary testing by generating fuzzed inputs before actual execution to detect potential buffer overflows. The overflow detection module proactively identifies vulnerable functions by testing with edge-case inputs, and the patch module prepares and applies patches in advance to prevent future security issues.
2Loss of time
If automated patching is performed, then time to resolve buffer overflow issues is reduced, but manufacturing precision requirements increase
Solution Approach 1:
The system uses feedback from the overflow detection module to guide the patch module. The detection module provides information about which functions are vulnerable and under what conditions, allowing the patch module to generate precise, context-aware patches that target specific locations and conditions without requiring manual precision.
Solution Approach 2:
The patch module changes parameters such as input validation thresholds, buffer size checks, and function call monitoring to prevent buffer overflows. By modifying these parameters dynamically based on the detected vulnerability patterns, the system can automatically generate precise patches without requiring manual intervention or extremely high manufacturing precision.
3Measurement precision
If fuzzed inputs are generated to test buffer overflow, then detection accuracy is improved, but use of energy increases
Solution Approach 1:
The system generates fuzzed inputs that are intentionally excessive or edge-case scenarios designed to trigger buffer overflow conditions. By using partial testing strategies that focus on critical input patterns rather than exhaustive testing, the system achieves high detection accuracy while managing energy consumption through targeted rather than comprehensive testing.
Data Source
AI summary
A method may include operating a program using an input that causes buffer overflow and determining minimum input length that causes buffer overflow and maximum input length that does not cause buffer overflow. The method may include operating program using first input that includes the maximum input length and second input that includes the minimum input length. The method may include collecting call/return pairs for each function of the program using the first and second input and determining, based on a difference between call/return pairs, a function that causes buffer overflow. The method may include determining whether a number of calls exceeds a threshold. In response to the number of calls exceeding the threshold, the method may include inserting a patch configured to prevent buffer overflow in a calling function.