OSQ Retreat. 11. Static Analysis From 10,000 ft. See 'p ', infer p is not SAFE ... Performance is good. May 22, 2002. OSQ Retreat. 20. Any Questions? ...
Memory bugs are hard to find. Memory safety ensures component isolation ... T1 * safe means that a pointer of the first kind is convertible to a pointer of second kind ...
Runtime preempts by setting a flag. Loader can verify placement ... Eliminate fine-grained locks (CCured, Java) Can we design a thread system that uses only this ...
Gives programmer access to the lowest levels of the machine. Worst feature of C: ... Dependable Embedded Components and Systems used in Europe and designed by comity ...
BugBench: A Benchmark for Evaluating Bug Detection Tools Shan Lu, Zhenmin Li, Feng Qin, Lin Tan, Pin Zhou and Yuanyuan Zhou University of Illinois, Urbana-Champaign
Lin Tan, Pin Zhou and Yuanyuan Zhou. University of Illinois, ... MySQL. msql-4.1.1. MSQL1. Data race. Apache. httpd-2.0.49. HTPD. Memory leak. squid. squid-2.4 ...
Model Checking is a technique to verify a system desc against a spec. Input: ... Temporal safty property (spec) Output: Proof of correctness. Counterexample ...
Checking Memory Safety with Blast. Paper by Dirk Beyer, Thomas ... Berkeley Lazy Abstraction Software ... Overkill for some checks. Not good for large ...
SafeDrive: Safe and Recoverable Extensions Using Language-Based Techniques Feng Zhou, Jeremy Condit, Zachary Anderson, Ilya Bagrak, Rob Ennals, Matthew Harren,
... is memory safe if: Only accesses objects it has allocated. Or the ones that it has been granted access. Null pointer dereferencing is an aspect of memory safety ...
Chapter 7 Bride of Buffer Overflow Chapter Synopsis Integers Wrap around errors Truncation and sign extension Conversions between unsigned and signed Methods to ...
CS463.11 Program Security UIUC CS463 Computer Security Software Security Software security perhaps most important topic in security Policies need mechanisms to ...
University of Illinois at Urbana-Champaign. Joint work with: Chris Lattner, Dinakar Dhurjati, Sumant Kowshik ... Example: Microsoft Longhorn (basis of Vista) ...
Refactoring C to Safer C. Bill McCloskey. Eric Brewer. One (1) ACME. Refactoring Tool ... C is a powerful language with many users and a huge base of legacy ...
Analysis tools for discovering vulnerabilities in source code and binaries ... Error-prone [Zhang et al., 02][Jaeger et al., 04] Violation of complete mediation ...
Bug fixing is a matter of triage. Important bugs happen often, to many users ... Like Arnold & Ryder, but statistically fair. Sharing the Cost of Assertions ...
Cyclone: A Memory-Safe C-Level Programming Language Dan Grossman University of Washington Joint work with: Trevor Jim AT&T Research Greg Morrisett Harvard University
Detecting String Manipulation Errors. An important problem. Common errors ... New Polka [IMAG - Bertrand Jeannet] Main steps: Simplifier. Pointer analysis. C2IP ...
Spatial Computation. A computation model based on: application ... HW compilation for spatial computation. Studied first-order properties of spatial computation ...
Region-Based Memory Management in Cyclone Dan Grossman Cornell University June 2002 Joint work with: Greg Morrisett, Trevor Jim (AT&T), Michael Hicks, James Cheney ...
Bitmap-based, segregated size classes. Bit represents one object of given size ... randomly probe bitmap for zero-bit (free) Fast: runtime O(1) M=2 ) E[# of ...
Bug Isolation via Remote Program Sampling Alex Aiken Ben Liblit Michael I. Jordan Alice X. Zheng UC Berkeley Always One More Bug Imperfect world with imperfect ...
Type-Safe Multithreading in Cyclone Dan Grossman Cornell University TLDI 2003 18 Jan 2003 Cyclone + threads = ? Cyclone is a safe language at the C level Target ...
Aid to Manual Analysis of Malicious Code. Aid to Recovery. Policy Considerations ... Automated Response to Malicious Code. Host-Based (B, overlaps with ...
The University of Texas. February 2004. T H E U N I V E R S I T Y O F. T E X ... Need tools to tame software development. 3. State of the art related systems ...
Usage based document classification ... insider threat detection in the Document Control domain ... Automatic safety conversion. 26. Extending Idea To Pointers ...
Instituto de Computaci n Facultad de la Republica. Universidad de la Rep blica ... Probador de Teoremas. Prueba. VC. CPU. Productor de C digo. Consumidor de C digo ...
... testing-like approach is developed to localize logic bugs in software ... Data mining into software or computer systems. 28. Our Other Work on Data Mining ...
Only block owner can free/transfer ownership. Trusted domain can access memory map API ... Stored in Register array or RAM: Area-Performance tradeoff. Updated ...
Samurai keeps 3 copies of every object at random locations in heap (to minimize ... Samurai required a heap size of 4MB but recovered from all faults successfully ...
1968 (conference on software crisis after IC invention, with more ... ????(Y2K,malicious buffer overflow) ???????????. ????????(Web Internet Platform Security) ...
Run in the same protection domain. Extensions are often buggier than hosts ... protection domain & virtual machines: Nooks [Swift et al], L4 [LeVasseur et al] ...