MemSafe: ensuring the spatial and temporal memory safety of C at runtime

Abstract

SUMMARYMemory access violations are a leading source of unreliability in C programs. As evidence of this problem, a variety of methods exist that retrofit C with software checks to detect memory errors at runtime. However, these methods generally suffer from one or more drawbacks including the inability to detect all errors, the use of incompatible metadata, the need for manual code modifications, and high runtime overheads. This paper presents a compiler analysis and transformation for ensuring the memory safety of C called MemSafe. MemSafe makes several novel contributions that improve upon previous work and lower the cost of safety. These include (i) a method for modeling temporal errors as spatial errors, (ii) a metadata representation that combines features of both object-based and pointer-based approaches, and (iii) a dataflow representation that simplifies optimizations for removing unneeded checks. MemSafe is capable of detecting real errors with lower overheads than previous efforts. Experimental results show that MemSafe detects all memory errors in six programs with known violations as well as two large and widely used open source applications. Finally, MemSafe ensures complete safety with an average overhead of 88% on 30 programs commonly used for evaluating the performance of error detection tools.

Fast as a shadow, expressive as a tree

“…They include safe dialects of C, specific fail-safe C compilers and memory safety verification tools for C code. In particular, the idea to store object metadata on valid memory blocks in a separate database was previously exploited in [13,21,27,10,1] and appeared welladapted for most spatial errors (that is, accesses outside the bounds [24]). Advantages of these solutions include relative efficiency (propagation of pointer metadata at each pointer assignment is not required) and compatibility (the memory layout of objects is preserved).…”

Runtime checking C programs

“…A softwarebased approach analogous to HardBound was explored in SoftBound [17]. MemSafe [25] extends this idea by using static analysis to prove memory accesses safe. ConSeq [29] identifies code locations, such as assertions or reads of key global variables.…”

Validation of memory accesses through symbolic analyses

“…Nevertheless, there exist several efforts to protect C programs against out-of-bounds accesses [1,13,22,29,30]. These projects change the memory allocation library used by C programs using different approaches: splay trees [13], shadowing [29], size information indexed through tables [22,30], validation through alignment constraints [1], etc. Our work is complementary to this previous research.…”