Instrumented Fuzz Testing Using AIR Integers

Instrumented Fuzz Testing Using AIR Integers

Cached

Download Links

[www.cert.org]

by Roger Dannenberg , Will Dormann , David Keaton , Robert C. Seacord , Timothy Wilson , Thomas Plum

Versions

Version 0

Version History

Metadata Version 0

Datum	Value	Source
TITLE	Instrumented Fuzz Testing Using AIR Integers	SVM HeaderParse 0.2
AUTHOR NAME	Roger Dannenberg	SVM HeaderParse 0.2
AUTHOR AFFIL	Associate Research Professor; School of Computer Science; Carnegie Mellon University	SVM HeaderParse 0.2
AUTHOR ADDR	Pittsburgh, PA 15213	SVM HeaderParse 0.2
AUTHOR NAME	Will Dormann	SVM HeaderParse 0.2
AUTHOR AFFIL	Software Engineering Institute; Carnegie Mellon University	SVM HeaderParse 0.2
AUTHOR ADDR	Pittsburgh, PA 15213; {wd, dmk, rcs,	SVM HeaderParse 0.2
AUTHOR NAME	David Keaton	SVM HeaderParse 0.2
AUTHOR AFFIL	Software Engineering Institute; Carnegie Mellon University	SVM HeaderParse 0.2
AUTHOR ADDR	Pittsburgh, PA 15213; {wd, dmk, rcs,	SVM HeaderParse 0.2
AUTHOR NAME	Robert C. Seacord	SVM HeaderParse 0.2
AUTHOR AFFIL	Software Engineering Institute; Carnegie Mellon University	SVM HeaderParse 0.2
AUTHOR ADDR	Pittsburgh, PA 15213; {wd, dmk, rcs,	SVM HeaderParse 0.2
AUTHOR NAME	Timothy Wilson	SVM HeaderParse 0.2
AUTHOR AFFIL	Software Engineering Institute; Carnegie Mellon University	SVM HeaderParse 0.2
AUTHOR ADDR	Pittsburgh, PA 15213; {wd, dmk, rcs,	SVM HeaderParse 0.2
AUTHOR NAME	Thomas Plum	SVM HeaderParse 0.2
AUTHOR AFFIL	Plum Hall	SVM HeaderParse 0.2
AUTHOR ADDR	Inc.; 3 Waihona Box 44610; Kamuela HI 96743	SVM HeaderParse 0.2
ABSTRACT	Integers represent a growing and underestimated source of vulnerabilities in C and C++ programs. In this paper, we present the as-if infinitely ranged (AIR) integer model, which provides a largely automated mechanism for eliminating integer overflow, truncation, and other integral exceptional conditions. The AIR integer model either produces a value equivalent to one that would have been obtained using infinitely ranged integers or results in a runtime-constraint violation. Instrumented fuzz testing of libraries that have been compiled using a prototype AIR integer compiler has been effective in discovering vulnerabilities in software with low false positive and false negative rates. Furthermore, the runtime overhead of the AIR integer model is low enough for typical applications to enable this feature in deployed systems for additional runtime protection.	SVM HeaderParse 0.2
CITATIONS	18 found	ParsCit 1.0