Re: Buffer overflow Article - CACM

[Georg Bauhaus <bauhaus@futureapps.de>]

Martin Krischik wrote:
 
> Is there an Online Version of that article? And if so: Would you mind if I
> copy/paste your Text to /. - That's only of you have no /. user yourself.

http://doi.acm.org/10.1145/1096000.1096004

The authors refer you to their site, in the final sentence of
their article. If you look at their "front page", the motivation of
their analyses will become clear. Please tr -d ' ' in
w w w . s m a s h  gu a r d .  or g

Some quotes:

"One way to prevent programs from having such vulnerabilities is
to write them using a language (such as Java or Pascal) that performs
bound checking. However, such languages often lack the low-level data
manipulation needed by some applications. Therefore, researchers have
produced "more secure" versions of C that are mostly compatible with
existing programs but add additional security features. Cyclone [5]
is one such C-language variant. Unfortunately, the performance cost
of bounds checking (reported in [5]) involves up to an additional
100% overhead."

"Dynamic protection techniques can be costly in terms of overhead,
but some researchers are trying to move that functionality into faster,
hardware-based protection schemes.
As these techniques move from academic laboratories into mainstream
software releases, computer users and software developers have become
aware of what they can do, and what they can't do."