CCured: type-safe retrofitting of legacy software

Abstract

This article describes CCured, a program transformation system that adds type safety guarantees to existing C programs. CCured attempts to verify statically that memory errors cannot occur, and it inserts run-time checks where static verification is insufficient.CCured extends C's type system by separating pointer types according to their usage, and it uses a surprisingly simple type inference algorithm that is able to infer the appropriate pointer kinds for existing C programs. CCured uses physical subtyping to recognize and verify a large number of type casts at compile time. Additional type casts are verified using run-time type information. CCured uses two instrumentation schemes, one that is optimized for performance and one in which metadata is stored in a separate data structure whose shape mirrors that of the original user data. This latter scheme allows instrumented programs to invoke external functions directly on the program's data without the use of a wrapper function.We have used CCured on real-world security-critical network daemons to produce instrumented versions without memory-safety vulnerabilities, and we have found several bugs in these programs. The instrumented code is efficient enough to be used in day-to-day operations.

Global ISR: Toward a Comprehensive Defense Against Unauthorized Code Execution

“…Write integrity testing [49] uses static analysis and "guard" values between variables to prevent memory corruption errors, but static analysis alone cannot correctly classify all program writes. CCured [50] is a source code transformation system that adds type safety to C programs, but it incurs a significant performance overhead and is unable to statically handle some data types. Generally, solutions that require recompilation of software are less practical, as source code or parts of it (e.g., third-party libraries) are not always available.…”

Survey of Protections from Buffer-Overflow Attacks

“…For example, there have been buffer-overflow attacks in Java [26,4], Perl [59], etc. There also exists a type-safe C: CCured [60].…”

Efficient and Effective Buffer Overflow Protection on ARM Processors

“…There are safe languages, referred to as safe dialects, that remain as close to C or C++ as possible. However, their performance overhead is also significant [4,5].…”

“…Some try to solve the problem entirely by inserting bound checks or modifying the language itself [3][4][5]. Others rely on randomness and secrets to detect or prevent modifications of data in memory.…”