Earticle

널 포인터 역참조 (Null Pointer Dereference) 취약점은 정상적인 메모리 주소를 저장한 포인터가 아닌 널 포인터를 참조할 때 발생하는 취약점이다. 그러므로, 서비스거부공격 (Denial-of-service)와 같은 공격에 악용되어 큰 피해를 줄 수 있기 때문에 식별하고 제거해야 할 중요한 취약점이다. 기존 연구에서는 기호실행과 같은 정적분석을 통해 취약점을 탐지하는 방법을 많이 제안하였다. 그러나 커널과 같은 복잡도가 높은 대형 프로그램을 검사할 때는 경로폭발 (path explosion)과 제약조건(constraint solver) 때문에 효율성이 제한되며 주어진 시간 내에 탐지하지 못할 수 있다. 또는 대형 프로그램 중 일부 함수들 혹은 라이브러리 함수를 탐지할 때 전체 프로그램의 상태를 알 수 없기 때문에 완전한 분석을 수행하지 못해 정확도가 높지 않은 경우가 있다. 본 논문에서는 소스코드가 없는 대규모 프로그램에서 특정한 일부 기능 검사 할 때 빠르고 정확하게 검사하기 위한 가벼운 취약점 탐지도구를 연구개발 하였다. 변수나 포인터를 기호로 표시하고 프로그램 실행을 에뮬레이션하여, 각 실행경로에서 데이터 의존성(data dependency) 분석과 휴리스틱 방법으로 널 포인터 역참조 취약점을 탐지한다. 기존 bap_toolkit과 실험하여 비교하였을 때 오탐율이 8% 높지만, 존재하는 취약점을 모두 탐지해냈다.

The Null Pointer Dereference vulnerability is a significant vulnerability that can cause severe attacks such as denial-of-service. Previous research has proposed methods for detecting vulnerabilities, but large and complex programs pose a challenge to their efficiency. In this paper, we present a lightweight tool for detecting specific functions in large binaryprograms through symbolizing variables and emulating program execution. The tool detects vulnerabilities through data dependency analysis and heuristics in each execution path. While our tool had an 8% higher false positive rate than the bap_toolkit, it detected all existing vulnerabilities in our dataset.

Steering vector and covariance matrix estimation mismatch along with moving jammer/platform, can affect the performance of null-steering beamformer. In this paper, by utilizing null-widening, null-deepening and diagonal loading shrinkage in space?time adaptive processing (STAP) structure, two methods for nullifying GNSS (global navigation satellite system) jamming/interference in cruise moving platforms are introduced. The enhanced performance of the proposed methods is investigated through numerical simulations. The results indicate improvement in the number of acquired GNSS satellites, in heavy jamming (GNSS denied) scenario, by reconstructing and acquiring at least 87% of satellites.

A method is described for ideally reconstructing the profile from a surface profiling measurement containing a reasonable amount of null measurement data. The proposed method can conjecture lost information and rectify irregular data that result due to bad measuring environments, signal transmission noise, or instrument-induced errors, The method adopts the concept of computer graphics and consists of several processing steps. First, a search for valid data in the neighborhood of the null data is performed. The valid data are then grouped and their contours are extracted. By analyzing these contours, a bounding box can be obtained and the general distribution of the entire area encompassing the valid and null data is determined Finally, an ideal surface model is overlaid onto the measurement results based on the bounding box, generating a complete reconstruction of the calculations, A surface-profiling task on a liquid crystal display photo spacer is used to verify the proposed method. The results are compared to those obtained through the use of a scanning electron microscope to demonstrate the accuracy of the proposed method.

Apoptosis is essential for a variety of pathophysiological progress. Apoptosis induction by various agents changes cellular morphology, DNA content and lipid membrane composition. Recently, sphingosine 1-phosphate (S1P) is avidly released from not only platelets and erythrocytes but vascular endothelium. Here we established S1P releasing cells by deleting S1P lyase (F9-12 cells). We observed apoptosis induction by the treatment of fumonisin B1 (FB1) in F9-12 cells but not in F9 wild-type cells. We measured high amounts of accumulated S1P and dihydroS1P (DHS1P) in FB1-induced apoptotic F9-12 cells. We also showed DHS1P release in an early stage of the apoptosis induction by FB1 but not by phorbol 12-myristate 13-acetate (PMA)-induced apoptosis, suggesting differential apoptotic processes.

In this paper I argue under the minimalist framework of Chomsky (1998, 1999) that null operators, in contrast to wh-operators, are basically regulated by the finiteness property of the clause(5) involved, in its distribution and aspects of movement, and demonstrate how the derivation of operator constructions is affected by the presence or absence of phonological contents in operators. The theoretical implication of this paper is that the postulation of null operators in English is not merely a linguistic artifact but rather a necessity of the theory of English to accommodate two essentially different operator constructions.

The purpose of this study is to propose that English non-finite clauses including ECM and small clauses(henceforth, SC) have a parallel internal structure with the verbal predication mediated by the copular BE. To support the idea, the English copular verb BE is classified as auxiliary and lexical verbs depending on its syntactic, semantic, and phonetic features, and then the lexical BE is sub-classified into the following two types: be-① and be-②. This paper argues that be-②’s semantic and phonetic features are lost in the process of Grammaticalization with only functional ones left. To consolidate the argument, some empirical evidences are presented from French and Nigerian Edo languages. In the Edo language especially, overt copular particles, whose morphology is totally distinct from its auxiliary BE, must exist in front of the predicate AP or NP whether it is placed in the main or embedded clauses. Based on these specimens, this paper contends that, instead of the functional category, the phonetically null functional element be-② mediates the predication and agreement between English SC subjects and predicates. Therefore, describing the SC complements and ECM as an identical TP structure seems worth pursing in that various English clausal structures can be explained uniformly by the head of T. (Chungnam National University)

One of the most well-known features of linguistic theory is that there exist various empty categories at various levels of mental representation. Languages such as Korean and Japanese are well-known for the fact that they allow arguments of a predicate to be freely dropped. Such null arguments have been a challenge to linguistic theory in that their contents are not recovered from the verbal agreement system. Simply put, null arguments occur in languages such as Korean, Mandarin, and Japanese, which has no agreement system whatsoever. If so, why should we allow the existence of pro? What types of empty categories appear in Korean? In order to give a plausible answer to these queries, we discuss the issue of assuming ECs such as PRO and pro. The present study assumes that both PRO and pro are allowed in Korean and that PRO appears as the subject of both tensed and untensed clauses, and pro as an empty pronominal in subject and object positions. Previous approaches assume that overt plural pronouns in Korean have a definite reading, whereas pro does not. Unfortunately, the picture turns out to be even more complicated. We have demonstrated in this paper that Korean pro can be more broadly used than the Korean overt pronoun ku in that pro can bear definite as well as indefinite interpretations, while overt pronouns have only definite interpretations. Finally, we have proposed that pro can function as a free variable depending on the speaker’s intention since the referent of pro is always influenced by the discriminating use of a demonstrative by the speaker. We have shown that this fact results from extending the spirit of Higginbotham’s (1992) analysis to pro.

This paper is concerned with null functional categories in Korean and its purpose is to show that they are accounted for in a principled manner by the Empty Category Principle, which implies that the Empty Category Principle is extended to accommodate a variety of functional categories. Attempts have been made to account for null complementizers and null determiners in various languages using the Empty Category Principle (Lamontagne and Travis 1987, Butler 1989, Hong 1994, Ahn 1996, and Lee 2004). In this paper, we will deal with various verbal and nominal affixes in Korean, which are generally assumed to belong to C, D, or P. First, we will discuss Comp -ko appearing in different types of embedded CPs and show that -ko can be phonologically null only if it satisfies the Empty Category Principle by being properly governed. Then we will discuss nominal affixes such as -ey, -eykey, and -lo and argue that they should be properly governed in order to be phonologically empty.

The purpose of this paper is to study the null subject phenomena in early child English with Schutze and Wexler's (1996) underspecification analysis. We consider some problems of their analysis. Alternatively, I present the Revised Underspecification Assumptions based on Chomsky's minimalist program.

When the idiomatic theme forms an idiom chunk with the verb root in the multiple Case marking(MCM) construction, even if the Case marker isn’t attached to the theme, it may appear in the verbal complement position, preserving an idiomatic meaning. The idiomatic(i.e., special) meaning formed at the level of V’ may induce the awkward sentence to make complete sense. Thus, the idiomatic nominative theme in the embedded clause cannot occupy the embedded null subject position coindexed with the matrix ECMed element. The idiomatic nominative theme is in the verbal complement position of the embedded clause of the ECM construction, which is the reason why the idiomatic meaning stays the same, even though the sentence is negated. The head Neg cannot block the head movement at the level of V’ since Neg is between T and v(or V).(Lee, 2016b)

This paper is devoted to the semantic behavior of null pronouns and overt pronouns. As observed earlier, both overt pronouns and null pronouns in Korean can take split antecedents. Such a fact suggests that Korean has two types of pronouns allowing split antecedents. Likewise, English pronouns, Korean overt pronouns, and Korean null pronouns with respect to demonstrative uses exhibit the same property. As for BVA, however, null pronouns do not behave like overt pronouns. The former induces a bound variable interpretation, but the latter may not. When it comes to the indirect/ direct test, Korean null pronouns attribute a direct thought like English PRO, whereas Korean overt pronouns attribute an indirect thought of the sort associated with English pronouns. Another peculiar property of null pronouns and overt pronouns is observed within opaque contexts. In this case, only the former gives rise to a de re thought, a thought that the speaker has about himself. Korean overt pronouns and null pronouns can also be E-type. Nonetheless, E-type overt pronouns and null pronouns differ in their definiteness. Finally, Korean null pronouns show characteristics similar to one in English, whereas overt pronouns present characteristics similar to the definite pronoun it. In conclusion, these semantic differences between overt pronouns and null pronouns seem to suggest that a null pronoun is not the genuine null counterpart of an overt pronoun in Korean.

One of the central doctrines of VP ellipsis and null anaphora is that they relate sloppy identity. The way they are hypothesized to do so is by postulating ambiguity of interpretation in the complete clause, or by treating null objects as a kind of VP ellipsis. What we have been arguing here is focussed on such semantic questions. However, it should be pointed out that there are problems at the very heart of the two analyses we have dealt with here. Attractive though the two analyses might be, they are empirically incorrect. Several problems are worth mentioning regarding them. First, the lambda abstraction-based approaches should always postulate ambiguity of interpretation in the complete clause that serves as a source for the elliptical clause. To put it differently, they require hidden ambiguity and the derivation of their rules is too procedural. Second, as stated in the course of our discussion, the lambda abstraction-based approaches and the equation-solving approach cannot account for the existence of the mixed reading under VP ellipsis. Third, the parallelism between the availability of the sloppy reading and that of a bound variable interpretation for a pronoun is not consistent. The sloppy reading can in fact arise independently of bound variable anaphora. Fourth, the NOC in Korean does not necessarily yield sloppy readings in the contexts where English VP ellipsis does. A further problem is that the NOC in Korean seems to require a different treatment. The results observed in this paper suggest that the NOC in Korean cannot be treated as analogous to VP ellipsis in English. Apart from theoretical considerations, there are empirical problems with the analysis treating the NOC in Korean as analogous to VP ellipsis in English.