Using programmer-written compiler extensions to catch security holes Export

@inproceedings{citeulike:514565, abstract = {This paper shows how system-specific static analysis can find security errors that violate rules such as "integers from untrusted sources must be sanitized before use" and "do not dereference user-supplied pointers." In our approach, programmers write system-specific extensions that are linked into the compiler and check their code for errors. We demonstrate the approach's effectiveness by using it to find over 100 security errors in Linux and OpenBSD, over 50 of which have led to kernel patches. An unusual feature of our approach is the use of methods to automatically detect when we miss code actions that should be checked.}, author = {Ashcraft, K. and Engler, D.}, citeulike-article-id = {514565}, citeulike-linkout-0 = {http://dx.doi.org/10.1109/SECPRI.2002.1004368}, citeulike-linkout-1 = {http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1004368}, doi = {10.1109/SECPRI.2002.1004368}, journal = {Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on}, keywords = {c, security}, pages = {143--159}, posted-at = {2007-11-07 14:33:39}, priority = {1}, title = {Using programmer-written compiler extensions to catch security holes}, url = {http://dx.doi.org/10.1109/SECPRI.2002.1004368}, year = {2002} }

TY - CONF ID - citeulike:514565 L3 - citeulike-article-id:514565 N2 - This paper shows how system-specific static analysis can find security errors that violate rules such as "integers from untrusted sources must be sanitized before use" and "do not dereference user-supplied pointers." In our approach, programmers write system-specific extensions that are linked into the compiler and check their code for errors. We demonstrate the approach's effectiveness by using it to find over 100 security errors in Linux and OpenBSD, over 50 of which have led to kernel patches. An unusual feature of our approach is the use of methods to automatically detect when we miss code actions that should be checked. JF - Security and Privacy, 2002. Proceedings. 2002 IEEE Symposium on EP - 159 TI - Using programmer-written compiler extensions to catch security holes SP - 143 KW - c KW - security AU - Ashcraft, K AU - Engler, D PY - 2002/// UR - http://dx.doi.org/10.1109/SECPRI.2002.1004368 ER -