The capabilities of seven dynamic buffer overflow detection tools (Chaperon, Valgrind, CCured, CRED, Insure++, ProPolice and TinyCC) are evaluated in this paper. These tools employ different approaches to runtime buffer overflow detection and range from commercial products to opensource gcc-enhancements. A comprehensive testsuite was developed consisting of speci?cally-designed test cases and model programs containing real-world vulnerabilities.

Insure++, CCured and CRED provide the highest buffer overflow detection rates, but only CRED provides an open-source, extensible and scalable solution to detecting buffer overflows. Other tools did not detect one-by-one errors, did not scale to large programs, or performed poorly on complex programs. Categories and Subject Descriptors D.2.4 [Software Engineering]: Software/Program Verification; D.2.5 [Software Engineering]: Testing and De- bugging; K.4.4 [Computers and Society]: Electronic Commerce Security General Terms Measurement, Performance, Security, Verification Keywords Security, buffer overflow, dynamic testing, evaluation, exploit, test, detection, source code

Download Dynamic Buffer Overflow Detection