软件安全性的静态分析  

Static analysis of software security

作　　者：余建军[1] 韩双霞[1] 黄云龙[1] 

机构地区：[1]衢州学院信电系,浙江衢州324006

出　　处：《计算机工程与设计》2006年第8期1411-1414,共4页Computer Engineering and Design

摘　　要：提出了基于整数区间和控制依赖图,通过静态分析来检测C语言源代码中安全漏洞的新方法。该方法在引入整数区间概念及其运算规则的基础上,把C语言中的数组、指针和整型表达式都抽象成整数区间,从而把相关安全性判断转换成整数区间之间的关系判断。最后讨论了该方法的具体算法。A static analysis method to detect security vulnerability in C source code is presented, which is based on Control dependence graph and integer range. Based on introducing integer range, array, pointer and integer expression in C language are abstracted into integer range, so the security judgment becomes the judgment of the relationship between integer ranges. Finally, the algorithm is discussed.

关 键 词：软件安全 静态分析 控制流图 整数区间 缓冲区溢出 整数溢出 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]