We present ClearView, a system for automatically patching errors in deployed software. ClearView works on stripped Windows x86 binaries without any need for source code, debugging information, or other external information, and without human intervention.ClearView (1) observes normal executions to learn invariants that characterize the application's normal behavior, (2) uses error detectors to monitor the execution to detect failures, (3) identifies violations of learned invariants that occur during failed executions, (4) generates candidate repair patches that enforce selected invariants by changing the state or the flow of control to make the invariant true, and (5) observes the continued execution of patched applications to select the most successful patch.ClearView is designed to correct errors in software with high availability requirements. Aspects of ClearView that make it particularly appropriate for this context include its ability to generate patches without human intervention, to apply and remove patches in running applications without requiring restarts or otherwise perturbing the execution, and to identify and discard ineffective or damaging patches by evaluating the continued behavior of patched applications.In a Red Team exercise, ClearView survived attacks that exploit security vulnerabilities. A hostile external Red Team developed ten code-injection exploits and used these exploits to repeatedly attack an application protected by ClearView. ClearView detected and blocked all of the attacks. For seven of the ten exploits, ClearView automatically generated patches that corrected the error, enabling the application to survive the attacks and successfully process subsequent inputs. The Red Team also attempted to make ClearView apply an undesirable patch, but ClearView's patch evaluation mechanism enabled ClearView to identify and discard both ineffective patches and damaging patches.

A compiler-checked immutability guarantee provides useful documentation, facilitates reasoning, and enables optimizations. This paper presents Immutability Generic Java (IGJ), a novel language extension that expresses immutability without changing Java's syntax by building upon Java's generics and annotation mechanisms. In IGJ, each class has one additional type parameter that is Mutable, Immutable, or ReadOnly. IGJ guarantees both reference immutability (only mutable references can mutate an object) and object immutability (an immutable reference points to an immutable object). IGJ is the first proposal for enforcing object immutability within Java's syntax and type system, and its reference immutability is more expressive than previous work. IGJ also permits covariant changes of type parameters in a type-safe manner, e.g., a readonly list of integers is a subtype of a readonly list of numbers. IGJ extends Java's type system with a few simple rules. We formalize this type system and prove it sound. Our IGJ compiler works by typeerasure and generates byte-code that can be executed on any JVM without runtime penalty.

Subtyping tests, i.e., determining whether one type is a subtype of another, are a frequent operation during the execution of objectoriented programs. The challenge is in encoding the hierarchy in a small space, while simultaneously making sure that subtyping tests have efficient implementation. We present a new scheme for encoding multiple and single inheritance hierarchies, which, in the standardized hierarchies, reduces the footprint of all previously published schemes. The scheme is called PQ-encoding after PQ-trees, a data structure previously used in graph theory for finding the orderings that satisfy a collection of constraints. In particular, we show that in the traditional object layout model, the extra memory requirements for single inheritance hierarchies is zero. In the PQ-encoding subtyping tests are constant time, and use only two comparisons. Other than PQ-trees, PQ-encoding uses several novel optimization techniques. These techniques are applicable also in improving the performance of other, previously published, encoding schemes.

No abstract

The Java language lacks the important notions of ownership (an object owns its representation to prevent unwanted aliasing) and immutability (the division into mutable, immutable, and readonly data and references). Programmers are prone to design errors, such as representation exposure or violation of immutability contracts. This paper presents Ownership Immutability Generic Java (OIGJ), a backward-compatible purely-static language extension supporting ownership and immutability. We formally defined a core calculus for OIGJ, based on Featherweight Java, and proved it sound. We also implemented OIGJ and performed case studies on 33,000 lines of code.Creation of immutable cyclic structures requires a "cooking phase" in which the structure is mutated but the outside world cannot observe this mutation. OIGJ uses ownership information to facilitate creation of immutable cyclic structures, by safely prolonging the cooking phase even after the constructor finishes.OIGJ is easy for a programmer to use, and it is easy to implement (flow-insensitive, adding only 14 rules to those of Java). Yet, OIGJ is more expressive than previous ownership languages, in the sense that it can type-check more good code. OIGJ can express the factory and visitor patterns, and OIGJ can type-check Sun's java.util collections (except for the clone method) without refactoring and with only a small number of annotations. Previous work required major refactoring of existing code in order to fit its ownership restrictions. Forcing refactoring of well-designed code is undesirable because it costs programmer effort, degrades the design, and hinders adoption in the mainstream community.

Abstract. The condition-based approachforsolving problemsin distributed systemsconsists of identifying sets of input vectors,c alled conditions ,forw hich itispossible tod esign moree fficientprotocols.Recentw orksuggested using the condition based approachi n asynchronous systems suffering from crashes, fors olving various agreementproblems [5,9,1,4,6].Thispaperdesignsafast condition-based consensus protocol for synchronous systems . 1IntroductionThe consensus problem standsin the heart of distributed systemsprone tofailures [2]. Inthisproblem eachprocess proposesavalueand all correctprocessesmust agree on one of the proposed values.Itiswell knownthatconsensus cannotbesolved in asynchronous systems even in the presenceofasingle possible crash. Manyways havebeen suggested tocircumventt hisimpossibility result,suchasconsidering aweakerproblem (approximateagreement,setagreement,and randomized algorithms)orastronger environment(failuredetectors,and partiallyasynchronous environment).The condition-based approach,whichi st he focus of thispaper,c onsists of identifying sets of input vectors,c alled conditions ,forw hichaproblem iss olvable. Recentw orkused the condition based approachinasynchronous systemssuffering from crashes,forsolving consensus ,where f ist he numberof processest hatcancrash. The difficulty isin designing a strictconsensus protocol,i.e.,aprotocol whichalsohandles inputs thatdo notbelong tothe condition. Mostefaouietal.[5]presented astrictconsensus protocol whichalways guarantee safety (i.e.,agreementand validity),however the protocol maynott erminatei fthe input doesnotbelong to C max f +1 .Moreg enerally, Mostefaouie tal. defined the class of d -legalconditionsand presented agenericprotocol forany f +1-legalcondition. Amoree fficientconsensus protocol fors tronger conditionswaspresented later [8,7].In synchronous systems itiswell knownthatsolving consensus requiresatleast f +1 rounds.Thispaperu sest he condition-based approachi no rdert od esign ac onsensus protocol whichrequiresasmallernumberof rounds.Specifically,for d -legalconditions, 1 ≤ d ≤ f +1,wepresentaprotocol whichsolvesconsensus in ( f +1) − ( d − 1)

No abstract

No abstract