Abstract: For the integer sign conversion faults, which result in buffer overflow vulnerabilities, an approach to detect integer sign conversion faults in binary programs dynamically is presented. Type inference method, based on a framework for binary instrumentation, is used to identify the sign information of integer variables. Then, a set of parameters are obtained, which have a conflict type in memory-related library functions, and are taken as candidate set of potential integer sign conversion faults. The test is run after inserting detection code on the level of intermediate representation to determine the real integer sign conversion faults. The experimental results on Sconvcheck show that this method can effectively detect integer sign conversion faults in binary programs and accurately locate the position the faults have occurred with a lower rate of false positives.

Key words: integer sign conversion faults, type inference, conflict type, binary programs, intermediate representation

摘要： 针对符号转换错误引起缓冲区溢出的这类缺陷提出了一种面向二进制程序整型符号转换缺陷检测方法。以二进制插桩框架为基础，利用类型推断方法识别整型变量的符号类型信息，得到内存相关库函数中为冲突类型的参数的集合，并将其作为潜在的整型符号转换缺陷候选集。在中间代码层面插入检测代码做运行时检测，最终确定真正的整型符号转换缺陷。原型系统Sconvcheck的实验结果表明：该方法可以有效地检测出程序中的整型符号转换缺陷，并准确地定位错误发生的位置，而且误报率较低。

关键词: 整数符号转换缺陷, 类型推断, 冲突类型, 二进制程序, 中间代码