Vulnerability assessment of source codeanalysis tools for memory corruptionvulnerabilities a comparative study

Background. One of the main reasons for memory corruption vulnerabilities lies in the lack of built in safety measures for the C/C++ programming language which is often time used to develop performance critical software. Static source code analysis tools perform a review of static(not running) source code usually by identifying sources of user input and data flow analysis in order to highlight potential security issues. Objectives. In this thesis we will also try to figure out which types of vulnerabilities related to memory corruption that could be discovered by these kinds of tools as well as which types that appears to be difficult to discover by using this approach.We will also investigate some suggestions for improvements. Methods. A comparative results of source code analysis tools written in C/C++ will take place for this thesis. The information needed in order to select the appropriate tools and test data will be derived from 1.Detection of the core reasons for each vulnerability. 2.Enumeration and separation of vulnerability cases. Results/conclusion. All of the tools were able to find less then half of the bufferoverflow vulnerabilities that existed in the data set and none of the tools were able to find any vulnerabilities related to integer overflow or use after free. The reason for this could very well be due to the tools limitations in their ability to find vulnerabilities caused by absence of correct processing. Keywords: Vulnerabilities, Memory corruption, buffer overflow, integer overflow,use after free, double fre