检索结果-内蒙古大学图书馆

A type system for object initialization in the Java bytecode language

ACM TRANSACTIONS ON PROGRAMMING LANGUAGES AND SYSTEMS 1999年第6期21卷 1196-1250页

作者： Freund, SN Mitchell, JC Stanford Univ Stanford CA 94305 USA

In the standard Java implementation, a Java language program is compiled to Java bytecode. This bytecode may be sent across the network to another site, where it is then executed by the Java Virtual Machine. Since bytecode may be written by hand, or corrupted during network transmission, the Java Virtual Machine contains a bytecode verifier that performs a number of consistency checks before code is run. These checks include type correctness and, as illustrated by previous attacks on the Java Virtual Machine, are critical for system security. In order to analyze existing bytecode verifiers and to understand the properties that should be verified, we develop a precise specification of statically correct Java bytecode, in the form of a type system. Our focus in this article is a subset of the bytecode language dealing with object creation and initialization. For this subset, we prove, that, for every Java bytecode program that satisfies our typing constraints, every object is initialized before it is used. The type system is easily combined with a previous system developed by Stata and Abadi for bytecode subroutines. Our analysis of subroutines and object initialization reveals a previously unpublished bug in the Sun JDK bytecode verifier.

关键词： languages verification bytecode languages Java object initialization type checking

来源：评论

学校读者我要写书评

暂无评论

MUSTI: Dynamic Prevention of Invalid object initialization Attacks

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2019年第8期14卷 2167-2178页

作者： Bartel, Alexandre Klein, Jacques Le Traon, Yves Univ Luxembourg SnT L-1359 Luxembourg Luxembourg

Invalid object initialization vulnerabilities have been identified since the 1990s by a research group at Princeton University. These vulnerabilities are critical since they can be used to totally compromise the security of a Java virtual machine (JVM). Recently, such a vulnerability identified as CVE-2017-3289 has been found again in the bytecode verifier of the JVM and affects more than 40 versions of the JVM. In this paper, we present a runtime solution called MUSTI to detect and prevent attacks leveraging this kind of critical vulnerabilities. We optimize MUSTI to have a runtime overhead below 0.5% and a memory overhead below 0.42%. Compared with state of the art, MUSTI is completely automated and does not require to manually annotate the code.

关键词： Java object initialization vulnerability sandbox

来源：评论

学校读者我要写书评

暂无评论

On object initialization in the Java bytecode

引用

COMPUTER COMMUNICATIONS 2000年第17期23卷 1594-1605页

作者： Doyon, S Debbabi, M Univ Laval Dept Comp Sci LSFM Res Grp St Foy PQ G1K 7P4 Canada

Java is an ideal platform for implementing mobile code systems, not only because of its portability but also because it is designed with security in mind. Untrusted Java programs can be statically analyzed and validated. The program's behavior is then monitored to prevent potentially malicious operations. Static analysis of untrusted classes is carried out by a component of the Java virtual machine called the verifier. The most complex part of the verification process is the dataflow analysis, which is performed on each method in order to ensure type-safety. This paper clarifies in detail one of the tricky aspects of the dataflow analysis: the verification of object initialization. We present and explain the rules that need to be enforced and we then show how verifier implementations can enforce them. Rules for object creation require, among other things, that uninitialized objects never be used before they are initialized. Constructors must properly initialize their this argument before they are allowed to return. This paper also deals with initialization failures (indicated by exceptions): the object being initialized must be discarded, and constructors must propagate initialization failures. (C) 2000 Elsevier Science B.V. All rights reserved.

关键词： Java bytecode object initialization Dataflow analysis static analysis Java security

来源：评论

学校读者我要写书评

暂无评论

A Type-and-Effect System for object initialization

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2020年第OOPSLA期4卷 1–28页

作者： Liu, Fengyun Lhotak, Ondrej Biboudis, Aggelos Giarrusso, Paolo G. Odersky, Martin Ecole Polytech Fed Lausanne Lausanne Switzerland Univ Waterloo Waterloo ON Canada Delft Univ Technol Delft Netherlands

Every newly created object goes through several initialization states: starting from a state where all fields are uninitialized until all of them are assigned. Any operation on the object during its initialization process, which usually happens in the constructor via this, has to observe the initialization states of the object for correctness, i.e. only initialized fields may be used. Checking safe usage of this statically, without manual annotation of initialization states in the source code, is a challenge, due to abasing and virtual method calls on this. Mainstream languages either do not check initialization errors, such as Java, C++, Scala, or they defend against them by not supporting useful initialization patterns, such as Swift. In parallel, past research has shown that safe initialization can be achieved for varying degrees of expressiveness but by sacrificing syntactic simplicity. We approach the problem by upholding local reasoning about initialization which avoids whole-program analysis, and we achieve typestate polymorphism via subtyping. On this basis, we put forward a novel type-and-effect system that can effectively ensure initialization safety while allowing flexible initialization patterns. We implement an initialization checker in the Scala 3 compiler and evaluate on several real-world projects.

关键词： object initialization Type-and-effect system

来源：评论

学校读者我要写书评

暂无评论

Template Constructors for Reusable object initialization 13

Template Constructors for Reusable Object Initialization

引用

12th International Conference on Generative Programming: Concepts and Experiences

作者： Martin, Marko Mezini, Mira Erdweg, Sebastian Tech Univ Darmstadt Darmstadt Germany

ISBN: (纸本)9781450323734

Reuse of and abstraction over object initialization logic is not properly supported in mainstream object-oriented languages. This may result in significant amount of boilerplate code and proliferation of constructors in subclasses. It also makes it impossible for mixins to extend the initialization interface of classes they are applied to. We propose template constructors, which employ template parameters and pattern matching of them against signatures of superclass constructors to enable a one-to-many binding of super-calls. We demonstrate how template constructors solve the aforementioned problems. We present a formalization of the concept, a Java-based implementation, and use cases which exercise its strengths.

关键词： Languages Theory constructors object initialization reusability mixins

来源：评论

学校读者我要写书评

暂无评论

Safe object initialization, abstractly 12

Safe object initialization, abstractly

引用

12th ACM SIGPLAN International Symposium on Scala, SCALA 2021, co-located with SPLASH 2021

作者： Liu, Fengyun Lhoták, OndÅ™ej Xing, Enze Pham, Nguyen Cao Oracle Labs Switzerland University of Waterloo Canada

ISBN: (纸本)9781450391139

objects under initialization are fragile: some of their fields are not yet initialized. Consequently, accessing those uninitialized fields directly or indirectly may result in program crashes or abnormal behaviors at runtime. A newly created object goes through several states during its initialization, beginning with all fields being empty until all of them are filled. However, ensuring initialization safety statically, without manual annotation of initialization states in the source code, is a challenge, due to aliasing, virtual method calls and typestate polymorphism. In this work, we introduce a novel analysis based on abstract interpreters to ensure initialization safety. Compared to the previous approaches, our analysis is simpler and easier to extend, and it does not require any user annotations. The analysis is inter-procedural, context-sensitive and flow-insensitive, yet it has good performance thanks to local reasoning and heap monotonicity. © 2021 ACM.

关键词： abstract interpreter heap monotonicity object initialization

来源：评论

学校读者我要写书评

暂无评论

Automatic Refinement Strategies for Manual initialization of object Trackers

引用

IEEE TRANSACTIONS ON IMAGE PROCESSING 2017年第2期26卷 821-835页

作者： Zhu, Hao Porikli, Fatih Beijing Inst Technol Sch Automat Beijing 100000 Peoples R China State Key Lab Intelligent Control & Decis Complex Beijing 100081 Peoples R China Australian Natl Univ Canberra ACT 0200 Australia

Tracking objects across multiple frames is a well-investigated problem in computer vision. The majority of the existing algorithms that assume an accurate initialization is readily available. However, in many real-life settings, in particular for applications where the video is streaming in real time, the initialization has to be provided by a human operator. This limitation raises an inevitable uncertainty issue. Here, we first collect a large and new data set of inputs that consists of more than 20 K human initialization clicks, by several subjects under three practical user interface scenarios for the popular TB50 tracking benchmark. We analyze the factors and mechanisms of human input, derive statistical models, and show that human input always contains deviations, which exacerbate further when the relative object-camera motion becomes large. We also design and evaluate alternative refinement schemes, and propose a strategy that refits an object window on the most probable target region after a single click. To compensate for the human initialization errors, our method generates window proposals using objectness cues extracted from color and motion attributes, accumulates them into a likelihood map that is weighted by the initial click position and visual saliency scores, and assigns the final window by the maximum likelihood estimate. Our experiments demonstrate that the presented refinement strategy effectively reduces human input errors.

关键词： object initialization object tracking human-computer interactive error compensation

来源：评论

学校读者我要写书评

暂无评论

Verified bytecode verifiers

引用

THEORETICAL COMPUTER SCIENCE 2003年第3期298卷 583-626页

作者： Klein, G Nipkow, T Tech Univ Munich Inst Informat D-85748 Garching Germany

Using the theorem prover Isabelle/HOL we have formalized and proved correct and executable bytecode verifier in the style of Kildall's algorithm for a significant subset of the Java Virtual Machine (JVM). First an abstract framework for proving correctness of data flow based type inference algorithms for assembly languages is formalized. It is shown that under certain conditions Kildall's algorithm yields a correct bytecode verifier. Then the framework is instantiated with our previous work about the JVM. Finally, we demonstrate the flexibility of the framework by extending our previous JVM model and the executable bytecode verifier with object initialization. (C) 2002 Published by Elsevier Science B.V.

关键词： Java bytecode verification theorem proving data flow analysis object initialization

来源：评论

学校读者我要写书评

暂无评论

Verified bytecode verifiers

Verified bytecode verifiers

引用

4th International Conference on Foundations of Software Science and Computation Structures

作者： Klein, G Nipkow, T Tech Univ Munich Inst Informat D-85748 Garching Germany

关键词： Java bytecode verification theorem proving data flow analysis object initialization

来源：评论

学校读者我要写书评

暂无评论

Practical Void Safety 1

引用

9th International Working Conference on Verified Software - Theories, Tools, and Experiments (VSTTE)

作者： Kogtenkov, Alexander Independent scientist Podolsk Russia

ISBN: (数字)9783319723082

ISBN: (纸本)9783319723082;9783319723075

Null pointer dereferencing remains one of the major issues in modern object-oriented languages. An obvious addition of keywords to distinguish between never null and possibly null references appears to be insufficient during object initialization when some fields declared as never null may be temporary null before the initialization completes. Unlike all previous publications on the subject, this work avoids explicit encoding of these intermediate states in programs in favor of statically checked validity rules that do not depend on special conditionally non-null types. I review all object initialization examples proposed earlier and I suggest new ones to compare applicability of different approaches. I demonstrate the usability of the proposed scheme on open-source libraries with a million lines of code that were converted to satisfy the rules.

关键词： Null pointer dereferencing Null safety Void safety object initialization Static analysis Library-level modularity

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：