{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T15:41:48Z","timestamp":1782834108906,"version":"3.54.5"},"publisher-location":"Cham","reference-count":47,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030299613","type":"print"},{"value":"9783030299620","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-29962-0_4","type":"book-chapter","created":{"date-parts":[[2019,9,14]],"date-time":"2019-09-14T23:03:29Z","timestamp":1568502209000},"page":"68-87","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["Static Detection of Uninitialized Stack Variables in Binary Code"],"prefix":"10.1007","author":[{"given":"Behrad","family":"Garmany","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Martin","family":"Stoffel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Robert","family":"Gawlik","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thorsten","family":"Holz","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2019,9,15]]},"reference":[{"key":"4_CR1","unstructured":"Andersen, L.O.: Program analysis and specialization for the C programming language. Ph.D. thesis (1994)"},{"key":"4_CR2","unstructured":"Andriesse, D., Chen, X., van der Veen, V., Slowinska, A., Bos, H.: An in-depth analysis of disassembly on full-scale x86\/x64 binaries. In: USENIX Security Symposium (2016)"},{"key":"4_CR3","doi-asserted-by":"crossref","unstructured":"Bruening, D., Zhao, Q.: Practical memory checking with Dr. Memory. In: Proceedings of the 9th Annual IEEE\/ACM International Symposium on Code Generation and Optimization (2011)","DOI":"10.1109\/CGO.2011.5764689"},{"key":"4_CR4","unstructured":"Budd, C.: Pwn2Own: Day 2 and Event Wrap-Up, March 2016. http:\/\/blog.trendmicro.com\/pwn2own-day-2-event-wrap\/"},{"issue":"1","key":"4_CR5","doi-asserted-by":"publisher","first-page":"146","DOI":"10.1109\/69.43410","volume":"1","author":"S Ceri","year":"1989","unstructured":"Ceri, S., Gottlob, G., Tanca, L.: What you always wanted to know about datalog (and never dared to ask). IEEE Trans. Knowl. Data Eng. 1(1), 146\u2013166 (1989)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"4_CR6","doi-asserted-by":"crossref","unstructured":"Chen, X., Slowinska, A., Bos, H.: Who allocated my memory? Detecting custom memory allocators in c binaries. In: 2013 20th Working Conference on Reverse Engineering (WCRE) (2013)","DOI":"10.1109\/WCRE.2013.6671277"},{"key":"4_CR7","doi-asserted-by":"crossref","unstructured":"Chen, X., Slowinska, A., Andriesse, D., Bos, H., Giuffrida, C.: StackArmor: comprehensive protection from stack-based memory error vulnerabilities for binaries. In: Symposium on Network and Distributed System Security (NDSS) (2015)","DOI":"10.14722\/ndss.2015.23248"},{"issue":"3","key":"4_CR8","doi-asserted-by":"publisher","first-page":"753","DOI":"10.1007\/s10664-015-9362-z","volume":"21","author":"X Chen","year":"2016","unstructured":"Chen, X., Slowinska, A., Bos, H.: On the detection of custom memory allocators in c binaries. Empirical Softw. Eng. 21(3), 753\u2013777 (2016)","journal-title":"Empirical Softw. Eng."},{"key":"4_CR9","unstructured":"CVE-2012-1889: Vulnerability in microsoft xml core services. http:\/\/www.cve.mitre.org\/cgi-bin\/cvename.cgi?name=cve-2012-1889"},{"key":"4_CR10","unstructured":"CVE-2014-6355: Graphics component information disclosure vulnerability. http:\/\/www.cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2014-6355"},{"key":"4_CR11","unstructured":"CVE-2015-0061: Tiff processing information disclosure vulnerability. http:\/\/www.cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2015-0061"},{"key":"4_CR12","unstructured":"CVE-Statistics-Chrome: Google Chrome Vulnerability Statistics (2014). http:\/\/www.cvedetails.com\/product\/15031\/Google-Chrome.html"},{"key":"4_CR13","unstructured":"CVE-Statistics-Firefox: Mozilla Firefox Vulnerability Statistics (2014). http:\/\/www.cvedetails.com\/product\/3264\/Mozilla-Firefox.html"},{"key":"4_CR14","unstructured":"CVE-Statistics-IE: Microsoft Internet Explorer Vulnerability Statistics (2014). http:\/\/www.cvedetails.com\/product\/9900\/Microsoft-Internet-Explorer.html"},{"issue":"4","key":"4_CR15","doi-asserted-by":"publisher","first-page":"451","DOI":"10.1145\/115372.115320","volume":"13","author":"R Cytron","year":"1991","unstructured":"Cytron, R., Ferrante, J., Rosen, B.K., Wegman, M.N., Zadeck, F.K.: Efficiently computing static single assignment form and the control dependence graph. ACM Trans. Program. Lang. Syst. (TOPLAS) 13(4), 451\u2013490 (1991)","journal-title":"ACM Trans. Program. Lang. Syst. (TOPLAS)"},{"key":"4_CR16","doi-asserted-by":"crossref","unstructured":"Evans, I., et al.: Control jujutsu: on the weaknesses of fine-grained control flow integrity. In: ACM Conference on Computer and Communications Security (CCS) (2015)","DOI":"10.1145\/2810103.2813646"},{"key":"4_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"297","DOI":"10.1007\/978-3-540-70952-7_20","volume-title":"Formal Methods: Applications and Technology","author":"A Fehnker","year":"2007","unstructured":"Fehnker, A., Huuck, R., Jayet, P., Lussenburg, M., Rauch, F.: Goanna\u2014a static model checker. In: Brim, L., Haverkort, B., Leucker, M., van de Pol, J. (eds.) FMICS 2006. LNCS, vol. 4346, pp. 297\u2013300. Springer, Heidelberg (2007). https:\/\/doi.org\/10.1007\/978-3-540-70952-7_20"},{"key":"4_CR18","unstructured":"Flake, H.: Attacks on uninitialized local variables (2006)"},{"key":"4_CR19","doi-asserted-by":"crossref","unstructured":"Giuffrida, C., Cavallaro, L., Tanenbaum, A.S.: Practical automated vulnerability monitoring using program state invariants. In: Conference on Dependable Systems and Networks (DSN) (2013)","DOI":"10.1109\/DSN.2013.6575318"},{"key":"4_CR20","doi-asserted-by":"crossref","unstructured":"Haller, I., Slowinska, A., Bos, H.: MemPick: data structure detection in C\/C++ binaries. In: Proceedings of the 20th Working Conference on Reverse Engineering (WCRE) (2013)","DOI":"10.1109\/WCRE.2013.6671327"},{"key":"4_CR21","unstructured":"Hariri, A.A.: VMware Exploitation through Uninitialized Buffers, March 2018. https:\/\/www.thezdi.com\/blog\/2018\/3\/1\/vmware-exploitation-through-uninitialized-buffers"},{"key":"4_CR22","doi-asserted-by":"crossref","unstructured":"Horwitz, S., Reps, T., Sagiv, M.: Demand interprocedural dataflow analysis, vol. 20. ACM (1995)","DOI":"10.1145\/222124.222146"},{"key":"4_CR23","doi-asserted-by":"crossref","unstructured":"Jin, W., et al.: Recovering C++ objects from binaries using inter-procedural data-flow analysis. In: Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop 2014 (2014)","DOI":"10.1145\/2556464.2556465"},{"key":"4_CR24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"553","DOI":"10.1007\/3-540-36577-X_40","volume-title":"Tools and Algorithms for the Construction and Analysis of Systems","author":"S Khurshid","year":"2003","unstructured":"Khurshid, S., P\u0102s\u0102reanu, C.S., Visser, W.: Generalized symbolic execution for model checking and testing. In: Garavel, H., Hatcliff, J. (eds.) TACAS 2003. LNCS, vol. 2619, pp. 553\u2013568. Springer, Heidelberg (2003). https:\/\/doi.org\/10.1007\/3-540-36577-X_40"},{"key":"4_CR25","doi-asserted-by":"crossref","unstructured":"Lee, J., et al.: Taming undefined behavior in LLVM. In: ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) (2017)","DOI":"10.1145\/3062341.3062343"},{"issue":"2","key":"4_CR26","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1145\/2644805","volume":"58","author":"B Livshits","year":"2015","unstructured":"Livshits, B., et al.: In defense of soundiness: a manifesto. Commun. ACM 58(2), 44\u201346 (2015)","journal-title":"Commun. ACM"},{"key":"4_CR27","doi-asserted-by":"crossref","unstructured":"Lu, K., Song, C., Kim, T., Lee, W.: Unisan: proactive kernel memory initialization to eliminate data leakages. In: ACM Conference on Computer and Communications Security (CCS) (2016)","DOI":"10.1145\/2976749.2978366"},{"key":"4_CR28","doi-asserted-by":"crossref","unstructured":"Lu, K., Walter, M.T., Pfaff, D., N\u00fcrnberger, S., Lee, W., Backes, M.: Unleashing use-before-initialization vulnerabilities in the Linux kernel using targeted stack spraying. In: Symposium on Network and Distributed System Security (NDSS) (2017)","DOI":"10.14722\/ndss.2017.23387"},{"key":"4_CR29","unstructured":"Machiry, A., Spensky, C., Corina, J., Stephens, N., Kruegel, C., Vigna, G.: DR. CHECKER: a soundy analysis for Linux kernel drivers. In: USENIX Security Symposium (2017)"},{"key":"4_CR30","doi-asserted-by":"crossref","unstructured":"Milburn, A., Bos, H., Giuffrida, C.: SafeInit: comprehensive and practical mitigation of uninitialized read vulnerabilities. In: Symposium on Network and Distributed System Security (NDSS) (2017)","DOI":"10.14722\/ndss.2017.23183"},{"key":"4_CR31","unstructured":"Molnar, D., Li, X.C., Wagner, D.A.: Dynamic test generation to find integer bugs in x86 binary Linux programs. In: USENIX Security Symposium (2009)"},{"key":"4_CR32","unstructured":"Ramos, D.A., Engler, D.: Under-constrained symbolic execution: Correctness checking for real code. In: USENIX Security Symposium (2015)"},{"issue":"1","key":"4_CR33","doi-asserted-by":"publisher","first-page":"162","DOI":"10.1145\/345099.345137","volume":"22","author":"T Reps","year":"2000","unstructured":"Reps, T.: Undecidability of context-sensitive data-dependence analysis. ACM Trans. Program. Lang. Syst. 22(1), 162\u2013186 (2000)","journal-title":"ACM Trans. Program. Lang. Syst."},{"key":"4_CR34","unstructured":"Reynolds, J.C.: Separation logic: a logic for shared mutable data structures. In: Proceedings of the 17th Annual IEEE Symposium on Logic in Computer Science, pp. 55\u201374. IEEE (2002)"},{"key":"4_CR35","unstructured":"Richardson, S., Ganapathi, M.: Interprocedural analysis useless for code optimization. Technical report, Stanford, CA, USA (1987)"},{"key":"4_CR36","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"133","DOI":"10.1007\/3-540-45306-7_10","volume-title":"Compiler Construction","author":"N Rinetzky","year":"2001","unstructured":"Rinetzky, N., Sagiv, M.: Interprocedural shape analysis for recursive programs. In: Wilhelm, R. (ed.) CC 2001. LNCS, vol. 2027, pp. 133\u2013149. Springer, Heidelberg (2001). https:\/\/doi.org\/10.1007\/3-540-45306-7_10"},{"key":"4_CR37","unstructured":"Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. Computer Science Department, New York University, New York, NY (1978)"},{"key":"4_CR38","doi-asserted-by":"crossref","unstructured":"Shoshitaishvili, Y., et al.: SOK: (state of) the art of war: offensive techniques in binary analysis. In: IEEE Symposium on Security and Privacy (2016)","DOI":"10.1109\/SP.2016.17"},{"key":"4_CR39","unstructured":"Slowinska, A., Stancescu, T., Bos, H.: Howard: a dynamic excavator for reverse engineering data structures. In: Symposium on Network and Distributed System Security (NDSS), San Diego, CA (2011)"},{"issue":"1","key":"4_CR40","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1561\/2500000014","volume":"2","author":"Y Smaragdakis","year":"2015","unstructured":"Smaragdakis, Y., Balatsouras, G.: Pointer analysis. Found. Trends Program. Lang. 2(1), 1\u201369 (2015)","journal-title":"Found. Trends Program. Lang."},{"key":"4_CR41","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"245","DOI":"10.1007\/978-3-642-24206-9_14","volume-title":"Datalog Reloaded","author":"Y Smaragdakis","year":"2011","unstructured":"Smaragdakis, Y., Bravenboer, M.: Using datalog for fast and easy program analysis. In: de Moor, O., Gottlob, G., Furche, T., Sellers, A. (eds.) Datalog 2.0 2010. LNCS, vol. 6702, pp. 245\u2013251. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-24206-9_14"},{"key":"4_CR42","doi-asserted-by":"crossref","unstructured":"Stepanov, E., Serebryany, K.: MemorySanitizer: fast detector of uninitialized memory use in C++. In: 2015 IEEE\/ACM International Symposium on Code Generation and Optimization (CGO) (2015)","DOI":"10.1109\/CGO.2015.7054186"},{"key":"4_CR43","doi-asserted-by":"crossref","unstructured":"Szekeres, L., Payer, M., Wei, T., Song, D.: SoK: eternal war in memory. In: IEEE Symposium on Security and Privacy (2013)","DOI":"10.1109\/SP.2013.13"},{"key":"4_CR44","unstructured":"Tillequin, A.: Amoco (2016). https:\/\/github.com\/bdcht\/amoco"},{"key":"4_CR45","unstructured":"Van Emmerik, M.J.: Static single assignment for decompilation. Ph.D. thesis, The University of Queensland (2007)"},{"key":"4_CR46","doi-asserted-by":"crossref","unstructured":"Wang, X., Chen, H., Cheung, A., Jia, Z., Zeldovich, N., Kaashoek, M.F.: Undefined behavior: what happened to my code? In: Proceedings of the Asia-Pacific Workshop on Systems (2012)","DOI":"10.1145\/2349896.2349905"},{"key":"4_CR47","doi-asserted-by":"crossref","unstructured":"Ye, D., Sui, Y., Xue, J.: Accelerating dynamic detection of uses of undefined values with static value-flow analysis. In: Proceedings of Annual IEEE\/ACM International Symposium on Code Generation and Optimization (2014)","DOI":"10.1145\/2544137.2544154"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2019"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-29962-0_4","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T00:10:40Z","timestamp":1726359040000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-29962-0_4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030299613","9783030299620"],"references-count":47,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-29962-0_4","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"15 September 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Luxembourg","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Luxembourg","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 September 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 September 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/conf.laas.fr\/esorics\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"344","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"67","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3,2","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"11","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}