Improving the Accuracy of Integer Signedness Error Detection Using Data Flow Analysis

Integer signedness error can be exploited by attackers to cause severe damages to computer systems. Despite of the significant advances in automating the detection of integer signedness errors, accurately differentiating exploitable and harmful signedness errors from unharmful ones still remains an open problem. In this paper, we present the design and implementation of SignFlow, an instrumentation-based integer signedness error detector to reduce the reports for unharmful signedness errors without sacrificing the completeness (i.e. no false negatives). SignFlow utilizes static data flow analysis to identify unharmful integer signedness conversions from the view of where the operands originate and whether the data after conversions can propagate to security-related operations, and then inserts security checks for the remaining conversions so as to accomplish runtime protection. We evaluated SignFlow on 7 real-world harmful integer signedness bugs, SPECint 2006 benchmarks together with 5 real-world applications. Experimental results show that SignFlow successfully detected all harmful integer signedness bugs and achieved a reduction of 41% in false positives over IntFlow, the state-of-the-art signedness error detector. Keywords—integer signedness error, data flow analysis, instrumentation, sanitization