Re: Good integer overflow papers?

[email protected]
Newsgroups gmane.comp.security.programming
Message-ID <[email protected]> 
Hey John,

JW> I'm looking for a good paper on integer overflows. I would like to see 
JW> some code examples and some guidelines on how to remedy the problem.
JW>     Blexim's paper "Basic Integer Overflows" provides code examples but 
JW> quite a few simply don't work the way he explains due to implicit 
JW> type-casting in C. Michael Howard from Microsoft has also written about 
JW> integer overflows in "Reviewing Code for Integer Manipulation 
JW> Vulnerabilities". Apart from these papers, any suggestions?

http://www.blackhat.com/presentations/bh-usa-02/bh-us-02-iss-sourceaudit.ppt
was IIRC the first public discussion of integer wraps by the folks that
found the OpenSSH challenge-response bug. It's less extensive than
most newer papers, but still covers what is needed.

Cheers,
[email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.