String manipulation errors pose significant security vulnerabilities in software development. This study explores challenges in detecting such errors, primarily using pointers and pointer arithmetic. Common issues include buffer overflows and incorrect NULL termination, which can lead to crashes and security breaches. We present a solution using powerful static domain analysis, focusing on modular analysis to improve precision and soundness. Our approach not only detects errors at logical points but also enhances user control over verification. We detail specifications for key functions like strcpy and custom implementations to ensure robust error management.
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation
Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement.Téléchargez la présentation en cliquant sur ce lien.Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.
F I N
Plus de contenu associé
Transcription de la présentation
CSSV – C String Static Verifier Nurit Dor Michael Rodeh Mooly Sagiv Greta Yorsh Tel-Aviv University http://www.cs.tau.ac.il/~nurr
The Problem:Detecting String Manipulation Errors • An important problem • Common errors • Cause security vulnerability • A challenging problem • Use of pointers • Use of pointer arithmetic • Error point vs. failure point
Example– unsafe call to strcpy() simple() { char s[20]; char *p; char t[10]; strcpy(s,”Hello”); p = s + 5; strcpy(p,” world!”); strcpy(t,s); }
buf cp Complicated Example /* from web2c [fixwrites.c] */ #define BUFSIZ 1024 char buf[BUFSIZ]; char insert_long(char *cp) { char temp[BUFSIZ]; … for (i = 0; &buf[i] < cp ; ++i) temp[i] = buf[i]; strcpy(&temp[i],”(long)”); strcpy(&temp[i+6],cp); … temp (long)
Complicated Example /* from web2c [fixwrites.c] */ #define BUFSIZ 1024 char buf[BUFSIZ]; char insert_long(char *cp) { char temp[BUFSIZ]; … for (i = 0; &buf[i] < cp ; ++i) temp[i] = buf[i]; strcpy(&temp[i],”(long)”); strcpy(&temp[i+6],cp); … buf cp temp ( l o n g )
buf cp Complicated Example /* from web2c [fixwrites.c] */ #define BUFSIZ 1024 char buf[BUFSIZ]; char insert_long(char *cp) { char temp[BUFSIZ]; … for (i = 0; &buf[i] < cp ; ++i) temp[i] = buf[i]; strcpy(&temp[i],”(long)”); strcpy(&temp[i+6],cp); … temp (long)
Are String Violations Common? • FUZZ study (1995) • Random test programs on various systems • 9 different UNIX systems • 18% – 23% hang or crash • 80% are string related errors • CERT advisory • 50% of attacks are abuses of buffer overflows
Current Methods • Static • Wagner et. al. [NDSS’00] • LCLint’s extension [USENIX’01] • Dor, Rodeh and Sagiv [SAS’01]
Goals • Static detection of string errors • References beyond array limit • Unsafe pointer arithmetic • Missing null terminator • Additional properties: • References beyond null • Specified using preconditions • Sound • Never miss errors • Few false alarms IS IT POSSIBLE ?
Challenges in Static Analysis • Soundness • Precision • Combine integer and pointer analysis (p+i) = ‘\0’; strcpy(q, p); • Scalability to handle real applications • Complexity of Chaotic iterations • Handles full C
CSSV Solution • Use powerful static domain • Exponential abstract interpretation • Use pre- and post-conditions to specify procedure requirements on strings • No interprocedural analysis • Modular analysis • Automatic generation of procedure specification
PreModPost Cfiles Cfiles AWP CSSV Pointer Analysis Procedure’sPointer info Procedure name C2IP Integer Proc Potential Error Messages Integer Analysis
Advantages of Specifications • Allows modular analysis • Not all the code is available • Enables more precise analyses • User control of the verification • Detect errors at point of logical error • Improve the precision of the analysis • Check additional properties • Beyond ANSI-C
Specification and Soundness • Preconditions are handled conservatively • All errors are detected • Inside a procedure’s bodyOR • At call statements to the procedure
PreModPost Cfiles Cfiles CSSV Pointer Analysis Procedure’sPointer info Procedure name C2IP Integer proc Potential Error Messages Integer Analysis
CSSV – Pointer Analysis • Models the string objects • Pre compute points-to information • Determines which objects may be updated thru a pointer char s[20]; char *p; … p = s + 5; strcpy(p,” world!”);
local p q s t r temp Integrating Pointer Information? foo(char *p, char *q) { char local[100]; … p = local; *q = 0; … } main() { char s[10], t[20], r[30]; char *temp; foo(s,t);foo(s,r); … temp = s … }
Projection for foo() foo(char *p, char *q) { char local[100]; … p = local; … } local p q param#1 param#2
PreModPost Cfiles Cfiles CSSV Pointer Analysis Procedure’sPointer info Procedure name C2IP Integer proc Potential Error Messages Integer Analysis
C2IP – C to Integer Program • Generate an integer program • Integer variables only • No function calls • Non deterministic • Goal: String error in the C program Assert violated in the IP
C2IP – C to Integer Program • Inline specification • Based on points-to information • Generate constraint variables • Generate assert statements • Generate update statements
C2IP - Use points-to information aloc1 p aloc5 *p = 0; if (…) { aloc1.len = p.offset; aloc1.is_nullt = true; } else { alloc5.len = p.offset; alloc5.is_nullt = true; }
Handling structures • Pointer analysis handles structures • C2IP handles pointer arithmetic • Generate constraint variables per field
PreModPost Cfiles Cfiles CSSV Pointer Analysis Procedure’sPointer info Procedure name C2IP Integer proc Potential Error Messages Integer Analysis
Integer Analysis • Interval analysis is not enough assert(-i cp.offset< -i +sbuf.len); • Use a powerful abstract domain • Polyhedra (Cousot Halbwachs, 78) • Statically analyzes program variable relations and detects constraints: a1* var1 + a2* var2 + … + an* varn b
y 1 x + y 3-x + y 1 V = <(1,2) (2,1) > R = <(1,0) (1,1)> 0 1 2 3 y 0 1 2 3 x Linear Relation Analysis • Statically analyzes program variable relations and detects constraints: a1* var1 + a2* var2 + … + an* varn b • Polyhedron
i = cp.offset 1018 buf cp temp Integer Analysis – insert_long() buf.offset = 0 temp.offest = 0 0 cp.offset = i i sbuf.len < s buf.msize sbuf.msize = 1024 stemp.msize= 1024 ( l o n g ) assert(0 i < 6 - stemp.msize ); // strcpy(&temp[i],"(long)"); Potential violation when cp.offset 1018
PreModPost Cfiles Cfiles AWP CSSV Pointer Analysis Procedure’sPointer info Procedure name C2IP Integer proc Potential Error Messages Integer Analysis
Cfiles Cfiles Pre AWP CSSV Pointer Analysis Procedure’sPointer info LeafProcedure C2IPside effect Mod Integer proc
Cfiles Cfiles Post CSSV Pointer Analysis Procedure’sPointer info LeafProcedure C2IPside effect Pre Mod Integer proc Potential Error Messages Integer Analysis
AWP • Approximate the Weakest Precondition • Backward integer analysis • Generates a precondition
PreModPost Core C Cfiles Cfiles Implementation – step 1 Inline Annotation Procedure name C’ Simplifier
Core C • Simplify the analysis implementation • A limited form of C expressions • Adds temporaries • At most one operator per statement • Convert value into location computation • No lost of precision
Core C Implementation – step 2 GOLF pointer analysis Procedure name GFCvisible variables Visible variables GlobalPointer info Procedure’spointer projection Procedure’sPointer info
Core C Pre Implementation – step 3 , 4 GFCC2IP Procedure name Integer Program ModularPointer info backward Integer Analysis forward Potential Error Messages
