Testing C Programs for Buffer Overflow Vulnerabilities

Speaker: Eric Haugh

Date: January 29, 2003

Abstract:
Buffer overflow vulnerabilities are a serious security problem for programs written in C. Traditional testing techniques, such as statement or branch coverage, are not good at uncovering such flaws. A testing method that augments traditional testing techniques can be used to uncover buffer overflow flaws in real programs. This method involves instrumenting the program under test with code that keeps track of memory buffers and checks the arguments to string functions from the C standard library. If this checking finds certain conditions, the program emits a warning. It does this when executed with ``normal'' test data as input, rather than input designed to trigger overflow. These warnings indicate the possiblity of a buffer overflow flaw in the program under test. A tool which implements this testing method was evaluated by testing three widely used, open source software packages. This evalutation shows that the tool is useful for finding buffer overflow flaws, that it has a good false positive rate, and compares well with other techniques.