NDLI: ARCHER:using symbolic, path-sensitive analysis to detect memory access errors

Content Provider	ACM Digital Library
Author	Engler, Dawson Xie, Yichen Chou, Andy
Abstract	Memory corruption errors lead to non-deterministic, elusive crashes. This paper describes ARCHER (ARray CHeckER) a static, effective memory access checker. ARCHER uses path-sensitive, interprocedural symbolic analysis to bound the values of both variables and memory sizes. It evaluates known values using a constraint solver at every array access, pointer dereference, or call to a function that expects a size parameter. Accesses that violate constraints are flagged as errors. Those that are exploitable by malicious attackers are marked as security holes.Memory corruption errors lead to non-deterministic, elusive crashes. This paper describes ARCHER (ARray CHeckER) a static, effective memory access checker. ARCHER uses path-sensitive, interprocedural symbolic analysis to bound the values of both variables and memory sizes. It evaluates known values using a constraint solver at every array access, pointer dereference, or call to a function that expects a size parameter. Accesses that violate constraints are flagged as errors. Those that are exploitable by malicious attackers are marked as security holes.We carefully designed ARCHER to work well on large bodies of source code. It requires no annotations to use (though it can use them). Its solver has been built to be powerful in the ways that real code requires, while backing off on the places that were irrelevant. Selective power allows it to gain efficiency while avoiding classes of false positives that arise when a complex analysis interacts badly with statically undecidable program properties. ARCHER uses statistical code analysis to automatically infer the set of functions that it should track --- this inference serves as a robust guard against omissions, especially in large systems which can have hundreds of such functions.In practice ARCHER is effective: it finds many errors; its analysis scales to systems of millions of lines of code and the average false positive rate of our results is below 35%. We have run ARCHER over several large open source software projects --- such as Linux, OpenBSD, Sendmail, and PostgreSQL --- and have found errors in all of them (118 in the case of Linux, including 21 security holes).
Starting Page	327
Ending Page	336
Page Count	10
File Format	PDF
ISSN	01635948
DOI	10.1145/949952.940115
Journal	ACM SIGSOFT Software Engineering Notes (SOEN)
Volume Number	28
Issue Number	5
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1979-04-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Buffer overrun Static analysis Error detection Memory access errors Buffer overflow Security
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

ARCHER: using symbolic, path-sensitive analysis to detect memory access errors

ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors (2003)

Marple: A Demand-Driven Path-Sensitive Buffer Overflow Detector (2008)

ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors

ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors (2003)

Validation of memory accesses through symbolic analyses

Refining buffer overflow detection via demand-driven path-sensitive analysis

Refining Buffer Overflow Detection via Demand-Driven Path-Sensitive Analysis

Buffer Overrun Detection using Linear Programming and Static Analysis (2003)

ARCHER:using symbolic, path-sensitive analysis to detect memory access errors

Similar Documents

ARCHER: using symbolic, path-sensitive analysis to detect memory access errors

ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors (2003)

Marple: A Demand-Driven Path-Sensitive Buffer Overflow Detector (2008)

ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors

ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors (2003)

Validation of memory accesses through symbolic analyses

Refining buffer overflow detection via demand-driven path-sensitive analysis

Refining Buffer Overflow Detection via Demand-Driven Path-Sensitive Analysis

Buffer Overrun Detection using Linear Programming and Static Analysis (2003)

ARCHER:using symbolic, path-sensitive analysis to detect memory access errors