IntFlow: Improving the Accuracy of Arithmetic Error Detection Using Information Flow Tracking

Integer overflow and underflow, signedness conversion, and other types of arithmetic errors in C/C++ programs are among the most common software flaws that result in ex-ploitable vulnerabilities. Despite significant advances in au-tomating the detection of arithmetic errors, existing tools have not seen widespread adoption mainly due to their in-creased number of false positives. Developers rely on wrap-around counters, bit shifts, and other language constructs for performance optimizations and code compactness, but those same constructs, along with incorrect assumptions and conditions of undefined behavior, are often the main cause of severe vulnerabilities. Accurate differentiation between legitimate and erroneous uses of arithmetic language intri-cacies thus remains an open problem. As a step towards addressing this issue, we present Int-Flow, an accurate arithmetic error detection tool that com-bines static information flow tracking and dynamic program analysis. By associating sources of untrusted input with the identified arithmetic errors, IntFlow differentiates between non-critical, possibly developer-intended undefined arithmetic operations, and potentially exploitable arithmetic bugs. Int-Flow examines a broad set of integer errors, covering almost all cases of C/C++ undefined behaviors, and achieves high error detection coverage. We evaluated IntFlow using the SPEC benchmarks and a series of real-world applications, and measured its effectiveness in detecting arithmetic error vulnerabilities and reducing false positives. IntFlow success-fully detected all real-world vulnerabilities for the tested ap-plications and achieved a reduction of 89 % in false positives over standalone static code instrumentation