1. A method for runtime self-protection of an application program, comprising: before running the application program: identifying input and output points in runtime code of the program; instrumenting the input points so as to cause the program to sense and cache potentially malicious inputs to the program; and instrumenting the output points so as to cause the program to detect outputs from the program corresponding to the cached inputs; and while running the application program: upon detecting, at an instrumented output point, an output corresponding to a cached input, evaluating a vulnerability of a target of the output to the cached input; and invoking a protective action upon determining that the output is potentially vulnerable to the cached input.