next up previous
Next: 1 Introduction

Detecting Format String Vulnerabilities with Type Qualifiers1

Umesh Shankar Kunal Talwar Jeffrey S. Foster David Wagner
University of California at Berkeley


We present a new system for automatically detecting format string security vulnerabilities in C programs using a constraint-based type-inference engine. We describe new techniques for presenting the results of such an analysis to the user in a form that makes bugs easier to find and to fix. The system has been implemented and tested on several real-world software packages. Our tests show that the system is very effective, detecting several bugs previously unknown to the authors and exhibiting a low rate of false positives in almost all cases. Many of our techniques are applicable to additional classes of security vulnerabilities, as well as other type- and constraint-based systems.

Umesh Shankar 2001-05-16