Smart Parser for Identifying and Detecting Insecure Functions

Buffer overflow is a known attack that exploits the software vulnerabilities by injecting an arbitrary code to gain a full or partial control on the targeted machine. Usually, the attackers target the C/C++ software applications that consist of insecure functions to overfill the buffer and crash that software. Thus, they cause a memory corruption, and run their arbitrary code. Several approaches have been developed to detect the buffer overflow. Those approaches rely mainly on static and dynamic analysis of the source code and generally require expertise in formal analysis and modeling of the source code and in some cases familiarity of binary code analysis. This paper proposes a smart parser that able to detect the C/C++ insecure functions that could be exploited by the buffer overflow attack. The smart parser is expected to be integrated with the early phase of the coding process as to help the software developers to coding their application securely. The smart parser has been implemented using Python and evaluated on five different applications that are written in C/C++ language. Additionally, the smart parser generates a report that shows the numbers and types of insecure functions that are found in each application.