Research on the Buffer Overflow Technology Based on GCC
|School||Harbin Engineering University|
|Course||Applied Computer Technology|
|Keywords||C language Buffer overflow Static detection Dynamic detection GCC|
With the rapid development of the network , computer software has been developed by leaps and bounds , it has been widely available in all areas of society . These software programs at the same time , there are some security vulnerabilities . Buffer overflow vulnerability is the most obvious one. This article is based on a the GCC compiler analysis , in -depth study of the static testing, dynamic detection method based on the combination of both methods of buffer overflow vulnerability detection method . Static detection method with reference to an integer and modeling analysis method, proposed to bind the two properties alloc ( s ) for each buffer s len ( s ) . The tracking two attributes of each buffer alloc ( s ) , len ( s ) in order to determine whether there has been a buffer overflow . Dynamic test method first dual-stack structure to achieve the separation of local variables . Secondly , on the basis of the dual-stack structure , motion detection, This prevents multiple functions between local variables cover . Finally, the local variable reordering , which prevents single function's local variables inside the cover . In this paper , by parsing the file to modify the GCC , the function calls and assignment statement two static detection methods . Experimental results show that it can test a simple pointer operations caused by buffer overflow . Modify the the GCC RTL intermediate structure and multiple front-end file and the ultimate realization of dynamic detection method . Experimental results show that it can terminate the program when an overflow occurs . Due to time constraints , the redistribution of this piece of local variables is not verified in the experiment .