¹Department of Computer Science, University of Colorado Boulder, CO 80309-0430, USA
²University of Colorado Boulder Cooperative Institute for Research in Environmental Sciences, USA.
³International College ofSemiconductor Technology, National Chiao Tung University, Taiwan.

---

Abstract—We address the problem of verifying a program to be free of Denial-of-Service memory vulnerabilities. More specifically, we define a program to be safe from DoS attacks if its memory usage at any time during execution is linear to sizes of its inputs. We design an analysis algorithm that verifies if a program satisfies this definition, and reports code snippets in the program that may cause a nonlinear amount of memory usage in case the verification fails. We also formally prove the correctness of our algorithm w.r.t. the above definition. Our experimental results indicate that the analysis algorithm is both effective and efficient.

Index Terms—Program verification, software security, static analysis.

[PDF]

Cite: Tianhan Lu, Yu-Ju Lee, Wen-Wei Liao, "Towards Denial-of-Service Memory Vulnerabilities," Journal of Software vol. 14, no. 9, pp. 423-436, 2019.