MemSafe: Ensuring the spatial and temporal memory safety of C at runtime

Proceedings - 10th IEEE International Working Conference on Source Code Analysis and Manipulation, SCAM 2010

Volumn , Issue , 2010, Pages 199-208

  Simpson, Matthew S ^a   Barua, Rajeev K ^a  

^a UNIVERSITY OF MARYLAND   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

C PROGRAMS; CODE MODIFICATIONS; COMPILER ANALYSIS; DATAFLOW; ERROR-DETECTION TOOLS; LARGE PROGRAMS; MEMORY ACCESS; MEMORY ERROR; MEMORY SAFETY; METADATA REPRESENTATION; RUNTIME OVERHEADS; RUNTIMES; SPATIAL ERRORS; TEMPORAL ERRORS; TEMPORAL MEMORY;

DATA FLOW ANALYSIS; METADATA; RETROFITTING;

ERROR DETECTION;

EID: 78649402279     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SCAM.2010.15     Document Type: Conference Paper

References (42)

1. R. W. M. Jones and P. H. J. Kelly, "Backwards-compatible bounds checking for arrays and pointers in C programs," in Proceedings of the 3rd InternationalWorkshop on Automatic Debugging, 1997, pp. 13-26.
2. C. Dahn and S. Mancoridis, "Using program transformation to secure c programs against buffer overflows," in Proceedings of the 10thWorking Conference on Reverse Engineering, 2003, p. 323.
3. L. Wang, J. R. Cordy, and T. R. Dean, "Enhancing security using legality assertions," in Proceedings of the 12th Working Conference on Reverse Engineering, 2005, pp. 35-44.
4. S. Nagarakatte, J. Zhao, M. M. K. Martin, and S. Zdancewic, "Soft- Bound: Highly compatible and complete spatial memory safety for C," in Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, 2009, pp. 245-258.
5. O. Ruwase and M. S. Lam, "A practical dynamic buffer overflow detector," in Proceedings of the Network and Distributed System Security Symposium, 2004, pp. 159-169.
6. D. Dhurjati and V. Adve, "Backwards-compatible array bounds checking for C with very low overhead," in Proceedings of the 28th International Conference on Software Engineering, 2006, pp. 162-171.
7. P. Akritidis, M. Costa, M. Castro, and S. Hand, "Baggy bounds checking: An efficient and backwards-compatible defense against outof- bounds errors," in Proceedings of the 18th USENIX Security Symposium, 2009.
8. US-CERT Vulnerability Notes Database, U.S. Computer Emergency Readiness Team, http://www.kb.cert.org/vuls/.
9. W. Xu, D. C. DuVarney, and R. Sekar, "An efficient and backwardscompatible transformation to ensure memory safety of C programs," in Proceedings of the 12th ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2004, pp. 117-126.
10. T. M. Austin, S. E. Breach, and G. S. Sohi, "Efficient detection of all pointer and array access errors," in Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, 1994, pp. 290-301.
11. H. Patil and C. Fischer, "Low-cost, concurrent checking of pointer and array accesses in C programs," Software: Practice & Experience, vol. 27, no. 1, pp. 87-110, 1997.
12. D. B. Wortman, "On legality assertions in euclid," IEEE Transactions on Software Engineering, vol. 5, no. 4, pp. 359-367, 1979.
13. T. Jim, J. G. Morrisett, D. Grossman, M. W. Hicks, J. Cheney, and Y.Wang, "Cyclone: A safe dialect of C," in Proceedings of the USENIX Annual Technical Conference, 2002, pp. 275-288.
14. J. P. Condit, "Dependent types for safe systems software," Ph.D. dissertation, University of California, Berkeley, 2007.
15. T. Ball and S. K. Rajamani, "The SLAM project: Debugging system software via static analysis," in Proceedings of the 29th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, 2002, pp. 1-3.
16. D. Beyer, T. A. Henzinger, R. Jhala, and R. Majumdar, "The software model checker BLAST: Applications to software engineering," International Journal on Software Tools for Technology Transfer, vol. 9, no. 5-6, pp. 505-525, 2007.
17. M. Das, S. Lerner, and M. Seigle, "ESP: Path-sensitive program verification in polynomial time," in Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation, 2002, pp. 57-68.
18. J. Criswell, A. Lenharth, D. Dhurjati, and V. Adve, "Secure virtual architecture: A safe execution environment for commodity operating systems," in Proceedings of the 21st ACM Symposium on Operating Systems Principles, 2007, pp. 351-366.
19. R. Hastings and B. Joyce, "Purify: A tool for detecting memory leaks and access errors in C and C++ programs," in Proceedings of the USENIX Winter Technical Conference, 1992, pp. 125-138.
20. S. H. Yong and S. Horwitz, "Protecting C programs from attacks via invalid pointer dereferences," in Proceedings of the 9th European Software Engineering Conference Held Jointly With the 11th ACM SIGSOFT International Symposium on Foundations of Software Engineering, 2003, pp. 307-316.
21. G. C. Necula, J. Condit, M. Harren, S. McPeak, and W. Weimer, "CCured: Type-safe retrofitting of legacy software," ACM Transactions on Programming Languages and Systems, vol. 27, no. 3, pp. 477-526, 2005.
22. Y. Oiwa, "Implementation of the memory-safe full ANSI-C compiler," in Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, 2009, pp. 259-269.
23. S. Lu, Z. Li, F. Qin, L. Tan, P. Zhou, and Y. Zhou, "BugBench: Benchmarks for evaluating bug detection tools," in Workshop on the Evaluation of Software Defect Detection Tools, 2005.
24. A. Rogers, M. C. Carlisle, J. H. Reppy, and L. J. Hendren, "Supporting dynamic data structures on distributed-memory machines," ACM Transactions on Programming Languages and Systems, vol. 17, no. 2, pp. 233-263, 1995.
25. M. Abadi, M. Budiu, Ú. Erlingsson, and J. Ligatti, "Control-flow integrity," in Proceedings of the 12th ACM Conference on Computer and Communications Security, 2005, pp. 340-353.
26. M. Castro, M. Costa, and T. Harris, "Securing software by enforcing data-flow integrity," in Proceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation, 2006, pp. 147-160.
27. P. Akritidis, C. Cadar, C. Raiciu, M. Costa, and M. Castro, "Preventing memory error exploits with WIT," in IEEE Symposium on Security and Privacy, 2008, pp. 263-277.
28. D. Dhurjati, S. Kowshik, and V. Adve, "SAFECode: Enforcing alias analysis for weakly typed languages," in Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, 2006, pp. 144-157.
29. H.-J. Boehm and M. Weiser, "Garbage collection in an uncooperative environment," Software: Practice & Experience, vol. 18, no. 9, pp. 807-820, 1988.
30. D. F. Bacon, P. Cheng, and D. Grove, "Garbage collection for embedded systems," in Proceedings of the 4th ACM International conference on Embedded Software, 2004, pp. 125-136.
31. B. Zorn, "The measured cost of conservative garbage collection," Software: Practice & Experience, vol. 23, no. 7, pp. 733-756, 1993.
32. R. Cytron, J. Ferrante, B. K. Rosen, M. N. Wegman, and F. K. Zadeck, "Efficiently computing static single assignment form and the control dependence graph," ACM Transactions on Programming Languages and Systems, vol. 13, no. 4, pp. 451-490, 1991.
33. S. Chandra and T. Reps, "Physical type checking for C," in Proceedings of the 1999 ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, 1999, pp. 66-75.
34. C. Lattner and V. Adve, "LLVM: A compilation framework for lifelong program analysis & transformation," in Proceedings of the International Symposium on Code Generation and Optimization (GCO), 2004, pp. 75-87.
35. L. O. Andersen, "Program analysis and specialization for the C programming language," Ph.D. dissertation, University of Copenhagen, 1994.
36. SPEC CPU Benchmarks, Standard Performance Evaluation Corporation, http://www.spec.org/.
37. J. Clause, I. Doudalis, A. Orso, and M. Prvulovic, "Effective memory protection using dynamic tainting," in Proceedings of the IEEE/ACM International Conference on Automated Software Engineering, 2007, pp. 284-292.
38. C. Lattner, "Macroscopic datastructure analysis and optimization," Ph.D. dissertation, University of Illinois, Urbana-Champaign, 2005.
39. J. Devietti, C. Blundell, M. M. K. Martin, and S. Zdancewic, "Hard- Bound: Architectural support for spatial safety of the C programming language," in Proceedings of the 13th International Conference on Architectural Support for Programming Languages and Operating Systems, 2008, pp. 103-114.
40. D. Dhurjati and V. Adve, "Efficiently detecting all dangling pointer uses in production servers," in Proceedings of the International Conference on Dependable Systems and Networks, 2006, pp. 269-280.
41. B. Perens, "Electric fence malloc debugger," http://perens.com/FreeSoftware/ElectricFence/.
42. E. D. Berger and B. G. Zorn, "DieHard: Probabilistic memory safety for unsafe languages," in Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, 2006, pp. 158-168.