Buffer Overrun detectiON

Update: BOON is obsolete technology. The state of research has advanced significantly since BOON was originally replaced, and commercial tools have surpassed BOON. This page is kept primarily for historical interest.

What. BOON is a tool for automatically finding buffer overrun vulnerabilities in C source code. Buffer overruns are one of the most common types of security holes, and we hope that BOON will enable software developers and code auditors to improve the quality of security-critical programs.

Caveats. BOON has many serious limitations and defects, and it is not for the faint of heart. I am not currently working on any further development of BOON, and it comes with no support. Be warned.

Where. The BOON release is available here.

Who. This software was written for David Wagner's Ph.D. dissertation, as part of a collaboration with Jeff Foster, Eric Brewer, and Alex Aiken. This work has been made possible by generous support from the National Science Foundation, as well as software from the BANE research group.

Paper trail. This tool is being made available as part of the software security research project, and the research behind BOON was documented a paper published at NDSS 2000, written by David Wagner, Jeffrey S. Foster, Eric A. Brewer, and Alexander Aiken, and titled A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities. More details on the technology inside BOON may be found in that paper.

Feedback. If you have patches, bugfixes, or urgent correspondence about the tool, you can send email to However, I can't offer any support for BOON: if you find any bugs, I probably won't be available to help fix them, and if you have usage questions, I probably won't have time to help.

Related tools. ITS4, RATS, flawfinder, Splint.

The BOON Authors (David Wagner),,