CSSV: Towards a Realistic Tool for Statically Detecting All Buffer Overflows In C (2000)
| Citations: | 100 - 5 self |
BibTeX
@MISC{Dor00cssv:towards,
author = {Nurit Dor and Michael Rodeh and Mooly Sagiv},
title = {CSSV: Towards a Realistic Tool for Statically Detecting All Buffer Overflows In C},
year = {2000}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Erroneous string manipulations are a major source of software defects in C programs yielding vulnerabilities which are exploited by software viruses. We present C String Static Verifyer (CSSV), a tool that statically uncovers all string manipulation errors. Being a conservative tool, it reports all such errors at the expense of sometimes generating false alarms. Fortunately, only a small number of false alarms are reported, thereby proving that statically reducing software vulnerability is achievable. CSSV handles large programs by analyzing each procedure separately. For this, procedures' contracts are allowed which are veri ed by the tool.
