利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

7 条记录 (耗时 0.024 秒)

    State-based source code annotation
    1.
    发明申请
    State-based source code annotation 审中-公开
    基于状态的源代码注释

    公开(公告)号：US20060271917A1

    公开(公告)日：2006-11-30

    申请号：US11142604

    申请日：2005-05-31

    申请人： Manuvir Das ,  Manuel Fahndrich ,  Ramanathan Venkatapathy ,  Yong Qu ,  Donn Scott Terry ,  Daniel Weise ,  Brian Hackett

    发明人： Manuvir Das ,  Manuel Fahndrich ,  Ramanathan Venkatapathy ,  Yong Qu ,  Donn Scott Terry ,  Daniel Weise ,  Brian Hackett

    IPC分类号： G06F9/44

    CPC分类号： G06F8/73 ,  G06F8/31

    摘要： Techniques and tools relating to state-based source code annotation are described. For example, described techniques include flexible techniques for describing object states with annotations. In one aspect, properties of data structures in source code are described using state-defining code annotations. For example, specification structs can be used to describe an arbitrary set of states of objects, thereby improving the capabilities of the annotation language in terms of richness of program description. Specification structs also help to avoid annotating large numbers of individual fields in data structures by allowing several individual fields to be described by a single specification struct. Other aspects of a source code annotation language also are described.

    摘要翻译： 描述与基于状态的源代码注释相关的技术和工具。 例如，所描述的技术包括用于通过注释描述对象状态的灵活技术。 在一个方面，使用状态定义代码注释来描述源代码中数据结构的属性。 例如，规范结构可用于描述对象的任意状态集合，从而在程序描述的丰富性方面提高注释语言的能力。 规范结构也有助于通过允许由单个规范结构描述几个单独的字段来避免在数据结构中注释大量的单个字段。 还描述了源代码注释语言的其他方面。

    Detection of security vulnerabilities in computer programs
    4.
    发明申请
    Detection of security vulnerabilities in computer programs 失效
    检测计算机程序中的安全漏洞

    公开(公告)号：US20070083933A1

    公开(公告)日：2007-04-12

    申请号：US11246391

    申请日：2005-10-07

    申请人： Ramanathan Venkatapathy ,  Jayaraman Thiagarajan ,  Dong Wei

    发明人： Ramanathan Venkatapathy ,  Jayaraman Thiagarajan ,  Dong Wei

    IPC分类号： G06F11/00

    CPC分类号： G06F21/577

    摘要： Methods and systems for analyzing a computer program use static and interprocedural analysis techniques and engines. A data processing operation, such as a function, is automatically identified within the computer program. It is determined whether the function represents a potential source for entry of untrusted data into the computer program. A course of the untrusted data is modeled through the identified function to produce a validation result, such as a call stack. Based on an attribute of the untrusted data (for example, whether the untrusted data is an unbounded integer or a string), it is determined whether the validation result identifies a security vulnerability of the computer program. A security vulnerability may exist, for example, when the modeled course of an unbounded integer through the function produces a buffer overrun in a call stack. The validation result is provided, via an API, software development tool, or user interface, for example.

    摘要翻译： 用于分析计算机程序的方法和系统使用静态和过程间分析技术和引擎。 在计算机程序内自动识别诸如功能的数据处理操作。 确定该功能是否表示用于将不可信数据输入计算机程序的潜在来源。 不可信数据的过程通过识别的功能进行建模，以产生验证结果，例如调用堆栈。 基于不可信数据的属性（例如，不受信任的数据是否是无界整数或字符串），确定验证结果是否识别计算机程序的安全漏洞。 可能存在安全漏洞，例如，当通过该函数的无界整数的建模过程在调用堆栈中产生缓冲区溢出时。 例如，通过API，软件开发工具或用户界面来提供验证结果。

    Defect detection for integers
    5.
    发明申请
    Defect detection for integers 失效

    公开(公告)号：US20060080578A1

    公开(公告)日：2006-04-13

    申请号：US10961635

    申请日：2004-10-07

    申请人： Jayaraman Thiagarajan ,  Ramanathan Venkatapathy

    发明人： Jayaraman Thiagarajan ,  Ramanathan Venkatapathy

    IPC分类号： G06F11/00

    CPC分类号： G06F11/3664 ,  G06F11/3604 ,  G06F11/366

    摘要： Various techniques can be used to detect programming defects relating to the use of integers. A data structure can be created to represent ordering relationships in software instructions. Such ordering relationships can represent common unsound programmer assumptions. After annotating the data structure, unvalidated ordering relationships can be identified. Validation can use both explicit and implicit techniques. Filtering can be used to focus on only significant integer expressions, such as those used in buffer operations. For example, buffer accesses that attempt out-of-bounds buffer accesses due to integer overflow can be detected.

    Defect detection for integers
    6.
    发明授权
    Defect detection for integers 失效
    整数缺陷检测

    公开(公告)号：US07624304B2

    公开(公告)日：2009-11-24

    申请号：US10961635

    申请日：2004-10-07

    申请人： Jayaraman Thiagarajan ,  Ramanathan Venkatapathy

    发明人： Jayaraman Thiagarajan ,  Ramanathan Venkatapathy

    IPC分类号： G06F11/00 ,  G06F9/44

    CPC分类号： G06F11/3664 ,  G06F11/3604 ,  G06F11/366

    摘要： Various techniques can be used to detect programming defects relating to the use of integers. A data structure can be created to represent ordering relationships in software instructions. Such ordering relationships can represent common unsound programmer assumptions. After annotating the data structure, unvalidated ordering relationships can be identified. Validation can use both explicit and implicit techniques. Filtering can be used to focus on only significant integer expressions, such as those used in buffer operations. For example, buffer accesses that attempt out-of-bounds buffer accesses due to integer overflow can be detected.

    摘要翻译： 可以使用各种技术来检测与使用整数相关的编程缺陷。 可以创建数据结构以表示软件指令中的排序关系。 这样的排序关系可以代表常见的不正确的程序员假设。 注释数据结构后，可以识别未验证的排序关系。 验证可以使用显式和隐式技术。 过滤可以用于仅关注显着的整数表达式，例如缓冲区操作中使用的那些。 例如，可以检测到由于整数溢出而尝试超出缓冲区访问的缓冲区访问。

    Preprocessor-based source code instrumentation
    7.
    发明授权
    Preprocessor-based source code instrumentation 失效
    基于预处理器的源代码检测

    公开(公告)号：US07484205B2

    公开(公告)日：2009-01-27

    申请号：US10319776

    申请日：2002-12-12

    申请人： Ramanathan Venkatapathy

    发明人： Ramanathan Venkatapathy

    IPC分类号： G06F9/45

    CPC分类号： G06F11/3624 ,  G06F8/42 ,  G06F8/423

    摘要： A preprocessor-based instrumentation technique wherein source code is provided to a compiler that exposes data structures such as symbols, types, expressions, etc. during the construction of the syntax tree in order to analyze where possible defects might make it desirable to instrument the code. Once a possible defect is detected in a segment of code, information is stored in a PI file detailing what line or lines of code to add, remove, or alter so that the code is instrumented to monitor the code segments at runtime. The PI file and source code are then provided to a preprocessor that uses the information in the PI file to insert instrumentation into the source code prior to the construction of a syntax tree. The now instrumented source code is used to build an instrumented syntax tree, which is then compiled so as to produce executable object code.

    摘要翻译： 一种基于预处理器的仪器技术，其中在编译语法树的过程中，将源代码提供给编译器，该编译器公开数据结构，如符号，类型，表达式等，以便在可能的情况下分析缺陷可能使代码 。 一旦在代码段中检测到可能的缺陷，信息就会存储在PI文件中，该文件详细说明要添加，删除或更改的代码行或代码行，以便代码在运行时监视代码段。 然后将PI文件和源代码提供给使用PI文件中的信息的预处理器，以便在构建语法树之前将检测工具插入到源代码中。 现在已经被调用的源代码用于构建一个仪器化的语法树，然后将其编译为产生可执行的目标代码。