CCured in the real world

Abstract

CCured is a program transformation system that adds memory safety guarantees to C programs by verifying statically that memory errors cannot occur and by inserting run-time checks where static verification is insufficient.This paper addresses major usability issues in a previous version of CCured, in which many type casts required the use of pointers whose representation was expensive and incompatible with precompiled libraries. We have extended the CCured type inference algorithm to recognize and verify statically a large number of type casts; this goal is achieved by using physical subtyping and pointers with run-time type information to allow parametric and subtype polymorphism. In addition, we present a new instrumentation scheme that splits CCured's metadata into a separate data structure whose shape mirrors that of the original user data. This scheme allows instrumented programs to invoke external functions directly on the program's data without the use of a wrapper function.With these extensions we were able to use CCured on real-world security-critical network daemons and to produce instrumented versions without memory-safety vulnerabilities.

Data Slicing: Separating the Heap into Independent Regions

“…In a sense, we introduce a limited form of inter-region pointer in exchange for the ability to restrict data slicing to a small portion of the program. In fact, this extension can be used to derive CCured's technique for restricting its compatible metadata representation [4]. Due to space constraints, we omit the remaining details.…”

“…CCured [4,10] is a program transformation system designed to guarantee memory safety in C programs through a combination of static analysis and run-time checks. To perform its run-time checks, CCured adds metadata to pointers, altering the layout of the program's data structures.…”

“…To solve this problem, CCured can separate its metadata from the original program's data, placing this metadata in a parallel structure [4]. Data slicing generalizes this technique, as discussed in Section 4.…”

“…In previous work [4], we introduced functions called C and Meta to describe the types of the separated data and metadata structures; the interested reader can verify that C = TSlice D • Rep and that Meta = TSlice M • Rep. (Note that in this paper, we use integer types instead of pointer types for the b and e fields. )…”

“…For example, a transformation that adds new fields to existing data structures may make the program incompatible with precompiled libraries; data slicing can be used to separate these new fields from the old ones, allowing the original program's data structures to retain their original layout. As the prototypical example of this application, we show how to instantiate data slicing in the context of the CCured project [4] to enable extensive run-time checking of C programs while maintaining compatibility with precompiled libraries.…”