As-If Infinitely Ranged Integer Model, Second Edition
Integers represent a growing and underestimated source of vulnerabilities in C and C++ programs. This report presents the as-if infinitely ranged (AIR) integer model that provides a largely automated mechanism for eliminating integer overflow and truncation and other integral exceptional conditions. The AIR integer model either produces a value equivalent to that obtained using infinitely ranged integers or results in a runtime-constraint violation. Instrumented fuzz testing of libraries that have been compiled using a prototype AIR integer compiler has been effective in discovering vulnerabilities in software with low false positive and false negative rates. Furthermore, the runtime overhead of the AIR integer model is low enough for typical applications to enable it in deployed systems for additional runtime protection.
Prototype
GCC 4.5.0
Technical Note
CMU/SEI-2010-TN-008
April 2010
Cite This Report
SEI:
Dannenberg, Roger; Dormann, Will; Keaton, David; Plum, Thomas; Seacord, Robert; Svoboda, David; Volkovitsky, Alex; & Wilson, Timothy. As-If Infinitely Ranged Integer Model, Second Edition (CMU/SEI-2010-TN-008). Software Engineering Institute, Carnegie Mellon University, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tn008.cfm
IEEE:
R. Dannenberg, W. Dormann, D. Keaton, T. Plum, R. Seacord, D. Svoboda, A. Volkovitsky, and T. Wilson, "As-If Infinitely Ranged Integer Model, Second Edition," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2010-TN-008, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tn008.cfm
APA:
Dannenberg, R., Dormann, W., Keaton, D., Plum, T., Seacord, R., Svoboda, D., Volkovitsky, A., & Wilson, T. (2010). As-If Infinitely Ranged Integer Model, Second Edition (CMU/SEI-2010-TN-008). Retrieved May 19, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/10tn008.cfm
CHI:
Dannenberg, Roger, Will Dormann, David Keaton, Thomas Plum, Robert Seacord, David Svoboda, Alex Volkovitsky, and Timothy Wilson. As-If Infinitely Ranged Integer Model, Second Edition (CMU/SEI-2010-TN-008). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tn008.cfm
MLA:
Dannenberg, R., Dormann, W., Keaton, D., Plum, T., Seacord, R., Svoboda, D., Volkovitsky, A., & Wilson, T. 2010. As-If Infinitely Ranged Integer Model, Second Edition (Technical Report CMU/SEI-2010-TN-008). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/10tn008.cfm
Find Us Here
Share This Page
For more information
