Detection of security vulnerabilities in computer programs

A system for analyzing source code of a computer program, comprising:

• a computer-readable storage medium;
• and
• a processor responsive to the computer-readable storage medium and to a computer program, the computer program, when loaded into the processor, operable to perform a method comprising
• generating an abstract syntax tree (“AST”) representation of the source code of the computer program,
• accessing a data entry point model, the data entry point model defining a plurality of predetermined function calls and a plurality of data entry point categories, at least some of the plurality of predetermined function calls associated with at least some of the plurality of data entry point categories,
• automatically identifying a plurality of data processing operations within a representation of at least a portion of the computer program within the AST representation,
• for each identified data processing operation of the identified plurality of data processing operations,
• determining whether the identified data processing operation represents a potential source for entry of untrusted data into the computer program, based on whether the identified data processing operation comprises one of the plurality of predetermined function calls within at least one of the plurality of data entry point categories,
• identifying an attribute of the untrusted data,
• in a depth-first fashion, modeling a course of the untrusted data through the identified data processing operation to produce a validation result, wherein the validation results comprises a call stack associated with the untrusted data, the call stack produced based on the modeled course of the untrusted data through the predetermined function,
• storing the validation result,
• based on the identified attribute, determining that the stored validation result identifies a security vulnerability of the computer program when the call stack includes a buffer overflow caused by the untrusted data, and wherein when the stored validation result identifies a security vulnerability, the stored validation result usable to identify a corresponding programming error in the source code, and
• providing access to the stored validation result, a quantity of identified security vulnerabilities, and an amount of intervention to assess and fix the corresponding programming errors in the source code, able to be reduced based on a number of predetermined function calls within the plurality of predetermined function calls, or a number of data entry point categories within the plurality of data entry point categories, or both.

A computer-readable storage medium encoded with computer-executable instructions which, when executed by a processor, perform a method for analyzing source code of a computer program, comprising:

• generating an abstract syntax tree (“AST”) representation of the source code of the computer program;
• accessing a data entry point model, the data entry point model defining a plurality of predetermined function calls and a plurality of data entry point categories, at least some of the plurality of predetermined function calls associated with at least some of the plurality of data entry point categories;
• automatically identifying a plurality of data processing operations within a representation of at least a portion of the computer program within the AST representation;
• for each identified data processing operation of the identified plurality of data processing operations,
• generating an extensible markup language (“XML”) model of the identified data processing operation, the XML model including information comprising an indication of the identified data processing operation, an indication of a source code file within which the identified data processing operation is located, an indication of a location of the identified data processing operation within the source code file, and an indication of call contexts;
• determining whether the identified data processing operation represents a potential source for entry of untrusted data into the computer program, based on whether the identified data processing operation comprises one of the plurality of predetermined function calls within at least one of the plurality of data entry point categories, and based on the indication of call contexts;
• identifying an attribute of the untrusted data;
• in a depth-first fashion, modeling a course of the untrusted data through the identified data processing operation to produce a validation result by using the XML model to track aliasing of the untrusted data through the identified data processing operation and by using the XML model to track validation of the untrusted data through the identified data processing operation;
• storing the validation result, wherein the stored validation result comprises a call stack associated with the untrusted data;
• based on the identified attribute, determining that the stored validation result identifies a security vulnerability of the computer program when the call stack includes a buffer overflow caused by the untrusted data;
• and
• providing access to the stored validation result, when the stored validation result identifies a security vulnerability, the stored validation result usable to identify a corresponding programming error in the source code, a quantity of identified security vulnerabilities, and an amount of intervention to assess and fix the corresponding programming errors in the source code, able to be reduced based on a number of predetermined function calls within the plurality of predetermined function calls, or a number of data entry point categories within the plurality of data entry point categories, or both.