Proving Memory Safety of the ANI Windows Image Parser Using Compositional Exhaustive Testing

We report in this paper how we proved memory safety of a complex Windows image parser written in low-level C in only three months of work and using only three core tech-niques, namely (1) symbolic execution at the x86 binary level, (2) exhaustive program path enumeration and testing, and (3) user-guided program decomposition and summariza-tion. We also used a new tool, named MicroX, for executing code fragments in isolation using a custom virtual machine designed for testing purposes. As a result of this work, we are able to prove, for the first time, that a Windows image parser is memory safe, i.e., free of any buffer-overflow secu-rity vulnerabilities, modulo the soundness of our tools and several additional assumptions regarding bounding input-dependent loops, fixing a few buffer-overflow bugs, and ex-cluding some code parts that are not memory safe by design. In the process, we also discovered and fixed several limita-tions in our tools, and narrowed the gap between systematic testing and verification. 1

A Compact Beam Stop for a Rare Kaon Decay Experiment

We describe the development and testing of a novel beam stop for use in a rare kaon decay experiment at the Brookhaven AGS. The beam stop is located inside a dipole spectrometer magnet in close proximity to straw drift chambers and intercepts a high-intensity neutral hadron beam. The design process, involving both Monte Carlo simulations and beam tests of alternative beam-stop shielding arrangements, had the goal of minimizing the leakage of particles from the beam stop and the resulting hit rates in detectors, while preserving maximum acceptance for events of interest. The beam tests consisted of measurements of rates in drift chambers, scintilation counter hodoscopes, a gas threshold Cherenkov counter, and a lead glass array. Measurements were also made with a set of specialized detectors which were sensitive to low-energy neutrons, photons, and charged particles. Comparisons are made between these measurements and a detailed Monte Carlo simulation.Comment: 39 pages, 14 figures, submitted to Nuclear Instruments and Method

Ionic and electronic structure of sodium clusters up to N=59

We determined the ionic and electronic structure of sodium clusters with even electron numbers and 2 to 59 atoms in axially averaged and three-dimensional density functional calculations. A local, phenomenological pseudopotential that reproduces important bulk and atomic properties and facilitates structure calculations has been developed. Photoabsorption spectra have been calculated for $\mathrm{Na}_2$, $\mathrm{Na}_8$, and $\mathrm{Na}_9^+$ to $\mathrm{Na}_{59}^+$. The consistent inclusion of ionic structure considerably improves agreement with experiment. An icosahedral growth pattern is observed for $\mathrm{Na}_{19}^+$ to $\mathrm{Na}_{59}^+$. This finding is supported by photoabsorption data.Comment: To appear in Phys. Rev. B 62. Version with figures in better quality can be requested from the author

Stability of the monoclinic phase in the ferroelectric perovskite PbZr(1-x)TixO3

Recent structural studies of ferroelectric PbZr(1-x)TixO3 (PZT) with x= 0.48, have revealed a new monoclinic phase in the vicinity of the morphotropic phase boundary (MPB), previously regarded as the the boundary separating the rhombohedral and tetragonal regions of the PZT phase diagram. In the present paper, the stability region of all three phases has been established from high resolution synchrotron x-ray powder diffraction measurements on a series of highly homogeneous samples with 0.42 <=x<= 0.52. At 20K the monoclinic phase is stable in the range 0.46 <=x<= 0.51, and this range narrows as the temperature is increased. A first-order phase transition from tetragonal to rhombohedral symmetry is observed only for x= 0.45. The MPB, therefore, corresponds not to the tetragonal-rhombohedral phase boundary, but instead to the boundary between the tetragonal and monoclinic phases for 0.46 <=x<= 0.51. This result provides important insight into the close relationship between the monoclinic phase and the striking piezoelectric properties of PZT; in particular, investigations of poled samples have shown that the monoclinic distortion is the origin of the unusually high piezoelectric response of PZT.Comment: REVTeX file, 7 figures embedde

Using the past to constrain the future: how the palaeorecord can improve estimates of global warming

Climate sensitivity is defined as the change in global mean equilibrium temperature after a doubling of atmospheric CO2 concentration and provides a simple measure of global warming. An early estimate of climate sensitivity, 1.5-4.5{\deg}C, has changed little subsequently, including the latest assessment by the Intergovernmental Panel on Climate Change. The persistence of such large uncertainties in this simple measure casts doubt on our understanding of the mechanisms of climate change and our ability to predict the response of the climate system to future perturbations. This has motivated continued attempts to constrain the range with climate data, alone or in conjunction with models. The majority of studies use data from the instrumental period (post-1850) but recent work has made use of information about the large climate changes experienced in the geological past. In this review, we first outline approaches that estimate climate sensitivity using instrumental climate observations and then summarise attempts to use the record of climate change on geological timescales. We examine the limitations of these studies and suggest ways in which the power of the palaeoclimate record could be better used to reduce uncertainties in our predictions of climate sensitivity.Comment: The final, definitive version of this paper has been published in Progress in Physical Geography, 31(5), 2007 by SAGE Publications Ltd, All rights reserved. \c{opyright} 2007 Edwards, Crucifix and Harriso

D* Production in Deep Inelastic Scattering at HERA

This paper presents measurements of D^{*\pm} production in deep inelastic scattering from collisions between 27.5 GeV positrons and 820 GeV protons. The data have been taken with the ZEUS detector at HERA. The decay channel $D^{*+}\to (D^0 \to K^- \pi^+) \pi^+$ (+ c.c.) has been used in the study. The $e^+p$ cross section for inclusive D^{*\pm} production with $5<Q^2<100 GeV^2$ and $y<0.7$ is 5.3 \pms 1.0 \pms 0.8 nb in the kinematic region {$1.3<p_T(D^{*\pm})<9.0$ GeV and $| \eta(D^{*\pm}) |<1.5$}. Differential cross sections as functions of p_T(D^{*\pm}), $\eta(D^{*\pm}), W$ and $Q^2$ are compared with next-to-leading order QCD calculations based on the photon-gluon fusion production mechanism. After an extrapolation of the cross section to the full kinematic region in p_T(D^{*\pm}) and $\eta$(D^{*\pm}), the charm contribution $F_2^{c\bar{c}}(x,Q^2)$ to the proton structure function is determined for Bjorken $x$ between 2 $\cdot$ 10$^{-4}$ and 5 $\cdot$ 10$^{-3}$.Comment: 17 pages including 4 figure

Solar parameters for modeling interplanetary background

The goal of the Fully Online Datacenter of Ultraviolet Emissions (FONDUE) Working Team of the International Space Science Institute in Bern, Switzerland, was to establish a common calibration of various UV and EUV heliospheric observations, both spectroscopic and photometric. Realization of this goal required an up-to-date model of spatial distribution of neutral interstellar hydrogen in the heliosphere, and to that end, a credible model of the radiation pressure and ionization processes was needed. This chapter describes the solar factors shaping the distribution of neutral interstellar H in the heliosphere. Presented are the solar Lyman-alpha flux and the solar Lyman-alpha resonant radiation pressure force acting on neutral H atoms in the heliosphere, solar EUV radiation and the photoionization of heliospheric hydrogen, and their evolution in time and the still hypothetical variation with heliolatitude. Further, solar wind and its evolution with solar activity is presented in the context of the charge exchange ionization of heliospheric hydrogen, and in the context of dynamic pressure variations. Also the electron ionization and its variation with time, heliolatitude, and solar distance is presented. After a review of all of those topics, we present an interim model of solar wind and the other solar factors based on up-to-date in situ and remote sensing observations of solar wind. Results of this effort will further be utilised to improve on the model of solar wind evolution, which will be an invaluable asset in all heliospheric measurements, including, among others, the observations of Energetic Neutral Atoms by the Interstellar Boundary Explorer (IBEX).Comment: Chapter 2 in the planned "Cross-Calibration of Past and Present Far UV Spectra of Solar System Objects and the Heliosphere", ISSI Scientific Report No 12, ed. R.M. Bonnet, E. Quemerais, M. Snow, Springe

Studies of the Cabbibo-Suppressed Decays D+→π0ℓ+νD^+ \to \pi^0 \ell^+ \nu and D+→ηe+νeD^+ \to \eta e^+ \nu_e

Using 4.8 fb$^{-1}$ of data taken with the CLEO II detector, the branching fraction for the Cabibbo-suppressed decay $D^+\to\pi^0\ell^+\nu$ measured relative to the Cabibbo favored decay $D^+\to\bar{K^0}\ell^+\nu$ is found to be $0.046\pm 0.014\pm 0.017$. Using $V_{cs}$ and $V_{cd}$ from unitarity constraints, we determine $| f_+^{\pi}(0)/f_+^K(0)|^2=0.9\pm 0.3\pm 0.3$ We also present a 90% confidence level upper limit for the branching ratio of the decay $D^+ \to \eta e^+\nu_e$ relative to that for $D^+ \to \pi^0 e^+\nu_e$ of 1.5.Comment: 10 page postscript file, postscript file also available through http://w4.lns.cornell.edu/public/CLN