OpenOSC: Open Source Object Size Checking Library With Built-in Metrics

No ratings

Presented at IEEESecDev 2019 by

Van Nguyen

Yongkui Han

Pankil Shah

Ling Ma

Richard Livingston

OpenOSC provides value to software developmentin detecting destination buffer overruns and source buffer overreads. OpenOSC is presented as open, extensible, object sizechecking (OSC) library written in C that integrates into mostLinux distribution components through hardening flags. It isquite similar to FORTIFY-SOURCE [1] [2] and can complementor replace it in most cases. Like FORTIFY-SOURCE, OpenOSCuses compiler built-in functions [3] in its implementation. Thefacility also offers some advantages over FORTIFY-SOURCEfor compiler and security researchers. Additionally it can beextended to cover more data movement functions such as SafeClibrary functions. OpenOSC has built-in OSC metrics support,which provides detailed information on OSC coverage.We present a few open source components compiled withOpenOSC as a means to demonstrate the utility of OpenOSC.The effectiveness of three compilers (GCC, CLANG, and ICC)is evaluated and compared. Our results summarize coveragecapabilities of these compilers and provide the details on exactlywhere a compiler might be able to improve its effectiveness.This OpenOSC metric report can be used by product ownersto understand where risk remains in the application, where theowners could focus secure code reviews or even targeted SafeC[4] [5] recoding for these calls.