Automatic Detection and Repair Recommendation for Missing Checks

来源 :计算机科学技术学报(英文版) | 被引量 : 0次 | 上传用户:jerry_ic
下载到本地 , 更方便阅读
声明 : 本文档内容版权归属内容提供方 , 如果您对本文有版权争议 , 可与客服联系进行内容授权或下架
论文部分内容阅读
Missing checks for untrusted inputs used in security-sensitive operations is one of the major causes of various vulnerabilities. Efficiently detecting and repairing missing checks are essential for prognosticating potential vulnerabilities and improving code reliability. We propose a systematic static analysis approach to detect missing checks for manipulable data used in security-sensitive operations of C/C++programs and recommend repair references. First, customized security-sensitive operations are located by lightweight static analysis. Then, the assailability of sensitive data used in security-sensitive operations is determined via taint analysis. And, the existence and the risk degree of missing checks are assessed. Finally, the repair references for high-risk missing checks are recommended. We implemented the approach into an automated and cross-platform tool named Vanguard based on Clang/LLVM 3.6.0. Large-scale experimental evaluation on open-source projects has shown its effectiveness and efficiency. Furthermore, Vanguard has helped us uncover five known vulnerabilities and 12 new bugs.
其他文献
期刊
目的 探讨螺旋CT检查在慢性化脓性中耳炎诊断分型及治疗中的价值。方法 对 65例 79耳慢性化脓性中耳炎行螺旋CT检查 ,将轴位HRCT、冠状位MPR及听骨链 3D重建图像与手术结果
期刊
目的调查饮水机对桶装饮用水中双酚A的二次污染状况,了解深圳居民桶装饮用水中双酚A的暴露水平。方法随机抽取饮水机34台,分别采集未经饮水机加热的桶装饮用水、经饮水机加热
首先论述了高光谱遥感在获取森林调查数据方面的优势;随后总结了国内外关于高光谱技术在树种识别、龄级分类、郁闭度调查及森林健康监测等方面的应用,并同时列举出高光谱遥感应用于林业上的主要处理技术;最后对高光谱遥感在我国林业上的应用现状进行了分析与展望。
期刊
Docker has been the mainstream technology of providing reusable software artifacts recently. Developers can easily build and deploy their applications using Doc
期刊
目的对2012-2014年邢台市人布鲁氏杆菌病疑似病例血清学结果进行分析,为做好预防控制工作提供依据。方法参照《布鲁氏菌病防治手册》、传染病WS 269-2007国家标准方法进行布
椎间盘钙化少见,尤以儿童及青少年钙化更少见,其原因不明,为特发性良性病变,本院最近遇见1例现报告如下.