RE: Good integer overflow papers?
"Michael Howard" <[email protected]>
| Newsgroups | gmane.comp.security.programming |
|---|---|
| Message-ID | <DAC3B5AD396A0C498B8C0717899D07805DB0C6@RED-MSG-41.redmond.corp.microsoft.com> |
Hey John I followed up this article with another at the end of september that touches on the subject a little more http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/ html/secure09112003.asp Cheers, Michael [Writing Secure Code 2nd Edition] http://www.microsoft.com/mspress/books/5957.asp [Protect Your PC] http://www.microsoft.com/protect [Blog] http://blogs.gotdotnet.com/mikehow -----Original Message----- From: John Wilander [mailto:[email protected]] Sent: Tuesday, November 04, 2003 5:40 AM To: [email protected] Subject: Good integer overflow papers? Hello SecProg debaters! I'm looking for a good paper on integer overflows. I would like to see some code examples and some guidelines on how to remedy the problem. Blexim's paper "Basic Integer Overflows" provides code examples but quite a few simply don't work the way he explains due to implicit type-casting in C. Michael Howard from Microsoft has also written about integer overflows in "Reviewing Code for Integer Manipulation Vulnerabilities". Apart from these papers, any suggestions? Best regards, John Wilander ______________________________________ John Wilander, PhD student Computer Science, Linkoping University http://www.ida.liu.se/~johwi