Patent ID: 7849509

Claim:
A computer-readable storage medium encoded with computer-executable instructions which, when executed by a processor, perform a method for analyzing source code of a computer program, comprising: generating an abstract syntax tree (“AST”) representation of the source code of the computer program; accessing a data entry point model, the data entry point model defining a plurality of predetermined function calls and a plurality of data entry point categories, at least some of the plurality of predetermined function calls associated with at least some of the plurality of data entry point categories; automatically identifying a plurality of data processing operations within the AST representation; for each identified data processing operation of the identified plurality of data processing operations, determining whether the identified data processing operation represents a potential source for entry of untrusted data into the computer program, based on whether the identified data processing operation comprises one of the plurality of predetermined function calls within at least one of the plurality of data entry point categories; identifying an attribute of the untrusted data; in a depth-first fashion, modeling a course of the untrusted data through the identified data processing operation to produce a validation result; storing the validation result, wherein the stored validation result comprises a call stack associated with the untrusted data; based on the identified attribute, determining that the stored validation result identifies a security vulnerability of the computer program when the call stack includes a buffer overflow caused by the untrusted data; and providing access to the stored validation result, when the stored validation result identifies a security vulnerability, the stored validation result usable to identify a corresponding programming error in the source code, a quantity of identified security vulnerabilities, and an amount of intervention to assess and fix the corresponding programming errors in the source code, able to be reduced based on a number of predetermined function calls within the plurality of predetermined function calls, or a number of data entry point categories within the plurality of data entry point categories, or both.