Patent ID: 8584246

Claim:
A system for eliminating false reports of security vulnerabilities when testing computer software, the system comprising: a computing system including a processor configured to: identify a tainted variable v in a computer application; identify a variable x within said application that holds data derived from v, wherein x is in a different format than v; identify an AddData operation within said application that is performed on x; identify a Sign operation within said application that is performed on the results of said AddData operation on x; identify an operation within said application that compares the results of said Sign operation with another value; and report said tainted variable v as a security vulnerability in response to not all of the following conditions being true: x is identified within said application that holds the content of v in a different format than v, at least one AddData operation is identified within said application that is performed on x, at least one Sign operation is identified within said application that is performed on the results of said AddData operation on x, and at least one operation is identified within said application that compares the results of said Sign operation with another value.