Finding bugs in exceptional situations of JNI programs

Siliang Li, Gang Tan

Research output: Chapter in Book/Report/Conference proceedingConference contribution

28 Scopus citations

Abstract

Software flaws in native methods may defeat Java's guarantees of safety and security. One common kind of flaws in native methods results from the discrepancy on how exceptions are handled in Java and in native methods. Unlike exceptions in Java, exceptions raised in the native code through the Java Native Interface (JNI) are not controlled by the Java Virtual Machine (JVM). Only after the native code finishes execution will the JVM's mechanism for exceptions take over. This discrepancy makes handling of JNI exceptions an error prone process and can cause serious security flaws in software written using the JNI. We propose a novel static analysis framework to examine exceptions and report errors in JNI programs. We have built a complete tool consisting of exception analysis, static taint analysis, and warning recovery. Experimental results demonstrated this tool allows finding of mishandling of exceptions with high accuracy (15.4% false-positive rate on over 260k lines of code). Our framework can be easily applied to analyzing software written in other foreign function interfaces, including the Python/C interface and the OCaml/C interface.

Original languageEnglish (US)
Title of host publicationCCS'09 - Proceedings of the 16th ACM Conference on Computer and Communications Security
Pages442-452
Number of pages11
DOIs
StatePublished - Dec 1 2009
Event16th ACM Conference on Computer and Communications Security, CCS'09 - Chicago, IL, United States
Duration: Nov 9 2009Nov 13 2009

Publication series

NameProceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)1543-7221

Other

Other16th ACM Conference on Computer and Communications Security, CCS'09
CountryUnited States
CityChicago, IL
Period11/9/0911/13/09

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Finding bugs in exceptional situations of JNI programs'. Together they form a unique fingerprint.

  • Cite this

    Li, S., & Tan, G. (2009). Finding bugs in exceptional situations of JNI programs. In CCS'09 - Proceedings of the 16th ACM Conference on Computer and Communications Security (pp. 442-452). (Proceedings of the ACM Conference on Computer and Communications Security). https://doi.org/10.1145/1653662.1653716