Citation Context

...or fine-grained detectors have been proposed that detect when a program is exploited. Most of these previous mechanisms require source code or special recompilation of the program, such as StackGuard =-=[14]-=-, PointGuard [13], full-bounds check [19, 37], LibsafePlus [5], FormatGuard [12], and CCured [27]. Some of them also require recompiling the libraries [19, 37], or modifying the original source code, ...

Citation Context

...to handle GCC extensions, which prevented them from working on software that use these extensions, such as Linux device drivers and kernels. 1 struct f int *fld; g *str1; 2 struct f int fld[5]; g str2=-=[4]-=-; 3 str1[1].fld[2]; 4 str2[1].fld[2]; Fig. 1. A short C program fragment highlighting ambiguous syntax. Extracting the precise meaning of a C program often requires additional processing of the abstra...

Citation Context

...ing in incomplete coverage. For example, McGary’s bounded pointers protect against some, but not all, array access violations [26], and StackGuard protects against some, but not all, buffer overflows =-=[9]-=-. Our goal with Cyclone is to prevent all safety violations. Moreover, previous projects have been presented as optional add-ons to C, so in practice they are seldom used in production code; Cyclone m...

Citation Context

...vial example is unsafe use of the C library functions strcpy or gets. This allows an attacker to corrupt adjacent structures containing program addresses, most often return addresses kept on the stack=-=[7]-=-. Buffer overflows affecting a regular data pointer can actually have a more disastrous effect by allowing a memory write to an arbitrary location on a subsequent use of that data pointer. One particu...

Citation Context

...d malicious code. To thwart such attacks, several approaches were developed, which, in one way or another, prevent undetected modifications to a function's return address. They include the StackGuard =-=[4]-=- approach of putting canary values around the return address, so that stack smashing can be detected when the canary value is clobbered; saving a second copy of return address elsewhere [3, 1]; and ot...

Citation Context

...<R2>+Imm T[R1]←T[R2]&Mask[1] Load LW R1, Imm(R2) <R1>←Mem[<R2>+Imm] Temp←T[Mem[<R2>+Imm]]; T[R1]←(Temp&Mask[0])|(T[R2]&Mask[2]) Store SW Imm(R1), R2 Mem[<R1>+Imm]←<R2> Temp←(T[R2]&Mask[0])|(T[R1]&Mask=-=[3]-=-); T[Mem[<R1>+Imm]]←Temp Branch/Jump JALR R1 <R31>←PC+4; PC←<R1> T[R31]←0 Table 1. Tag computations for tracking each type of dependencies. <Ri> represents the value in a general purpose register, and...

Citation Context

...tection techniques are attractive because of their accuracy in detecting errors. A typical run-time approach is to instrument code with dynamic guards during the compilation phase. Cowan's Stackguard =-=[15]-=- is representative of this approach; its low overhead and high accuracy has led to its inclusion in a variety of commercial software packages. Immunix Secured Linux 7+ is a commercial distribution of ...

Citation Context

...y rewrites executed binaries to add run-time return-address checks, thus imposing a significant overhead. Compiler Tricks Perhaps the best-known approach to countering buffer overflows is Stack Guard =-=[24]-=-. This is a patch to the popular gcc compiler that inserts a canary word right before the return address in a function’s activation record on the stack. The canary is checked just before the function ...

Citation Context

...additional manual e#ort, can also potentially find bugs in the cleanup code. In the future, the CMC approach could easily be coupled with other dynamic debugging tools such as Purify[27] or StackGuard=-=[6]-=-. These tools can catch run-time errors such as uses of uninitialized memory, stack overflows, etc. Such tools would be more e#ective when used with CMC than with ordinary testing, because CMC would a...