Patent ID: 7870610
Filing Date: 2011-01-11
Classification: G06F

Abstract:
1. A processor-implemented method for detecting unauthorized actions on a computing platform, comprising: designating as a tainted memory region, each memory region to which a received data set is stored in response to the received data set being received at the computing platform from an untrusted source, wherein each tainted memory region is addressable by the computing platform; designating a destination region as a tainted memory region in response to an invocation of a first-type operation on the computing platform, the invocation including at least first and second arguments to the operation, wherein the first argument references a source memory region and the second argument references the destination memory region, and at least a portion of an address range of the source region overlaps an address range of a tainted memory region, and the first-type operation uses data from the source region to update the destination region; determining whether an argument in an invocation of a selected function call references a tainted memory region, in response to the invocation of the function call on the computing platform; wherein the determining includes: outputting data indicative of the function call being unauthorized in response to determining that the argument references a tainted memory region.