TY - GEN
T1 - PAriCheck
T2 - 5th ACM Symposium on Information, Computer and Communication Security, ASIACCS 2010
AU - Younan, Yves
AU - Philippaerts, Pieter
AU - Cavallaro, Lorenzo
AU - Sekar, R.
AU - Piessens, Frank
AU - Joosen, Wouter
PY - 2010
Y1 - 2010
N2 - Buffer overflows are still a significant problem in programs written in C and C++. In this paper we present a bounds checker, called PAriCheck, that inserts dynamic runtime checks to ensure that attackers are not able to abuse buffer overflow vulnerabilities. The main approach is based on checking pointer arithmetic rather than pointer dereferences when performing bounds checks. The checks are performed by assigning a unique label to each object and ensuring that the label is associated with each memory location that the object inhabits. Whenever pointer arithmetic occurs, the label of the base location is compared to the label of the resulting arithmetic. If the labels differ, an out-of-bounds calculation has occurred. Benchmarks show that PAriCheck has a very low performance overhead compared to similar bounds checkers. This paper demonstrates that using bounds checkers for programs or parts of programs running on high-security production systems is a realistic possibility.
AB - Buffer overflows are still a significant problem in programs written in C and C++. In this paper we present a bounds checker, called PAriCheck, that inserts dynamic runtime checks to ensure that attackers are not able to abuse buffer overflow vulnerabilities. The main approach is based on checking pointer arithmetic rather than pointer dereferences when performing bounds checks. The checks are performed by assigning a unique label to each object and ensuring that the label is associated with each memory location that the object inhabits. Whenever pointer arithmetic occurs, the label of the base location is compared to the label of the resulting arithmetic. If the labels differ, an out-of-bounds calculation has occurred. Benchmarks show that PAriCheck has a very low performance overhead compared to similar bounds checkers. This paper demonstrates that using bounds checkers for programs or parts of programs running on high-security production systems is a realistic possibility.
KW - bounds checking
KW - buffer overflows
UR - https://www.scopus.com/pages/publications/77954495640
U2 - 10.1145/1755688.1755707
DO - 10.1145/1755688.1755707
M3 - Conference contribution
SN - 9781605589367
T3 - Proceedings of the 5th International Symposium on Information, Computer and Communications Security, ASIACCS 2010
SP - 145
EP - 156
BT - Proceedings of the 5th International Symposium on Information, Computer and Communications Security, ASIACCS 2010
Y2 - 13 April 2010 through 16 April 2010
ER -