Results 1 - 10
of
24
CCured: Type-Safe Retrofitting of Legacy Code
- PRINCIPLES OF PROGRAMMING LANGUAGES
, 2002
"... In this paper we propose a scheme that combines type inference and run-time checking to make existing C programs type safe. We describe the CCured type system, which extends that of C by separating pointer types according to their usage. This type system allows both pointers whose usage can be verif ..."
Abstract
-
Cited by 286 (9 self)
- Add to MetaCart
In this paper we propose a scheme that combines type inference and run-time checking to make existing C programs type safe. We describe the CCured type system, which extends that of C by separating pointer types according to their usage. This type system allows both pointers whose usage can be verified statically to be type safe, and pointers whose safety must be checked at run time. We prove a type soundness result and then we present a surprisingly simple type inference algorithm that is able to infer the appropriate pointer kinds for existing C programs. Our experience with the CCured system shows that the inference is very effective for many C programs, as it is able to infer that most or all of the pointers are statically verifiable to be type safe. The remaining pointers are instrumented with efficient run-time checks to ensure that they are used safely. The resulting performance loss due to run-time checks is 0–150%, which is several times better than comparable approaches that use only dynamic checking. Using CCured we have discovered programming bugs in established C programs such as several SPECINT95 benchmarks.
Backwards-compatible bounds checking for arrays and pointers in C programs
- in Distributed Enterprise Applications. HP Labs Tech Report
, 1997
"... function-typed variables, virtual functions, and 7/7 call-backs. 8/8 Maintain shadow bitmap: Maintain a map indicating which storage regions are valid. Update it when stack allocations, malloc and free occur. Augment each memory access instruction with code to check whether the address is valid ..."
Abstract
-
Cited by 165 (0 self)
- Add to MetaCart
function-typed variables, virtual functions, and 7/7 call-backs. 8/8 Maintain shadow bitmap: Maintain a map indicating which storage regions are valid. Update it when stack allocations, malloc and free occur. Augment each memory access instruction with code to check whether the address is valid [Hastings and Joyce, 1992]. Advantages: Fairly ecient Doesn't require access to source code, so can (must) be applied to all constituents of application False negatives - fails to ag accesses to a valid region using an 9/9 improperly-derived pointer 10/10 Summarise requirements: Track intended referent for each pointer It is not good enough just to check that accesses are to valid locations No change to pointer representation In order to inter-operate with unchecked code without restriction, no information can be bundled with the pointer. 11/11 How to do it . . . 3: the central idea Invariant: Assume all stored pointers are properly-derived pointers to their intended referent Im
Memory Management with Explicit Regions
, 1998
"... Much research has been devoted to studies of and algorithms for memory management based on garbage collection or explicit allocation and deallocation. An alternative approach, region-based memory management, has been known for decades, but has not been wellstudied. In a region-based system each allo ..."
Abstract
-
Cited by 115 (4 self)
- Add to MetaCart
Much research has been devoted to studies of and algorithms for memory management based on garbage collection or explicit allocation and deallocation. An alternative approach, region-based memory management, has been known for decades, but has not been wellstudied. In a region-based system each allocation specifies a region, and memory is reclaimed by destroying a region, freeing all the storage allocated therein. We show that on a suite of allocation-intensive C programs, regions are competitive with malloc/free and sometimes substantially faster. We also show that regions support safe memory management with low overhead. Experience with our benchmarks suggests that modifying many existing programs to use regions is not difficult. 1 Introduction The two most popular memory management techniques are explicit allocation and deallocation, as in C's malloc/free, and various forms of garbagecollection [Wil92]. Both have well-known advantages and disadvantages, discussed further below. A t...
CCured: Type-Safe Retrofitting of Legacy Software
- ACM Transactions on Programming Languages and Systems
, 2005
"... This paper describes CCured, a program transformation system that adds type safety guarantees to existing C programs. CCured attempts to verify statically that memory errors cannot occur, and it inserts run-time checks where static verification is insu#cient ..."
Abstract
-
Cited by 91 (7 self)
- Add to MetaCart
This paper describes CCured, a program transformation system that adds type safety guarantees to existing C programs. CCured attempts to verify statically that memory errors cannot occur, and it inserts run-time checks where static verification is insu#cient
CCured in the Real World
- In Proceedings of the ACM SIGPLAN 2003 Conference on Programming Language Design and Implementation
, 2003
"... CCured is a program transformation system that adds memory safety guarantees to C programs by verifying statically that memory errors cannot occur and by inserting run-time checks where static verification is insu#cient. ..."
Abstract
-
Cited by 79 (3 self)
- Add to MetaCart
CCured is a program transformation system that adds memory safety guarantees to C programs by verifying statically that memory errors cannot occur and by inserting run-time checks where static verification is insu#cient.
Efficient Techniques for Comprehensive Protection from Memory Error Exploits
, 2005
"... Despite the wide publicity received by buffer overflow attacks, the vast majority of today’s security vulnerabilities continue to be caused by memory errors, with a significant shift away from stack-smashing exploits to newer attacks such as heap overflows, integer overflows, and format-string attac ..."
Abstract
-
Cited by 61 (4 self)
- Add to MetaCart
Despite the wide publicity received by buffer overflow attacks, the vast majority of today’s security vulnerabilities continue to be caused by memory errors, with a significant shift away from stack-smashing exploits to newer attacks such as heap overflows, integer overflows, and format-string attacks. While comprehensive solutions have been developed to handle memory errors, these solutions suffer from one or more of the following problems: high overheads (often exceeding 100%), incompatibility with legacy C code, and changes to the memory model to use garbage collection. Address space randomization (ASR) is a technique that avoids these drawbacks, but existing techniques for ASR do not offer a level of protection comparable to the above techniques. In particular, attacks that exploit relative distances between memory objects aren’t tackled by existing techniques. Moreover, these techniques are susceptible to information leakage and brute-force attacks. To overcome these limitations, we develop a new approach in this paper that supports comprehensive randomization, whereby the absolute locations of all (code and data) objects, as well as their relative distances are randomized. We argue that this approach provides probabilistic protection against all memory error exploits, whether they be known or novel. Our approach is implemented as a fully automatic source-to-source transformation which is compatible with legacy C code. The address-space randomizations take place at load-time or runtime, so the same copy of the binaries can be distributed to everyone — this ensures compatibility with today’s software distribution model. Experimental results demonstrate an average runtime overhead of about 11%.
Low-cost, Concurrent Checking of Pointer and Array Accesses in C Programs
"... Execution Shadow processing was motivated, in part, by a tool called AE that supports abstract execution [17]. AE is used for efficient generation of detailed program traces. A source program, in C, is instrumented to record a small set of key events during execution. After execution these events s ..."
Abstract
-
Cited by 53 (1 self)
- Add to MetaCart
Execution Shadow processing was motivated, in part, by a tool called AE that supports abstract execution [17]. AE is used for efficient generation of detailed program traces. A source program, in C, is instrumented to record a small set of key events during execution. After execution these events serve as input to an abstract version of the original program that can recreate a full trace of the original program. The events recorded by the original program include control flow decisions. These are essentially the same data needed by a shadow process to follow a main process. AE is a post-run technique that shifts some of the costs involved in tracing certain incidents during a program's execution to the program that uses those incidents. In contrast, shadow processing is a run-time technique that removes expensive tracing from the critical execution path of a program and shifts it to another processor. Table 7: Concurrent Guarding using Shadow Processing: (user + system) time Program ...
High Coverage Detection of Input-Related Security Faults
, 2003
"... Improperly bounded program inputs present a major class of program defects. In secure applications, these bugs can be exploited by malicious users, allowing them to overwrite buffers and execute harmful code. In this paper, we present a high coverage dynamic technique for detecting software faults c ..."
Abstract
-
Cited by 47 (2 self)
- Add to MetaCart
Improperly bounded program inputs present a major class of program defects. In secure applications, these bugs can be exploited by malicious users, allowing them to overwrite buffers and execute harmful code. In this paper, we present a high coverage dynamic technique for detecting software faults caused by improperly bounded program inputs. Our approach is novel in that it retains the advantages of dynamic bug detection, scope and precision; while at the same time, relaxing the requirement that the user specify the input that exposes the bug. To implement our approach, inputs are shadowed by additional state that characterize the allowed bounds of input-derived variables. Program operations and decision points may alter the shadowed state associated with input variables. Potentially hazardous program sites, such as an array references and string functions, are checked against the entire range of values that the user might specify. The approach found several bugs including two high-risk security bugs in a recent version of OpenSSH.
An efficient and backwards-compatible transformation to ensure memory safety of c programs
- In Proc. 12th ACM SIGSOFT Symposium on Foundations of Software Engineering
, 2004
"... Memory-related errors, such as buffer overflows and dangling pointers, remain one of the principal reasons for failures of C programs. As a result, a number of recent research efforts have focused on the problem of dynamic detection of memory errors in C programs. However, existing approaches suffer ..."
Abstract
-
Cited by 41 (4 self)
- Add to MetaCart
Memory-related errors, such as buffer overflows and dangling pointers, remain one of the principal reasons for failures of C programs. As a result, a number of recent research efforts have focused on the problem of dynamic detection of memory errors in C programs. However, existing approaches suffer from one or more of the following problems: inability to detect all memory errors (e.g., Purify), requiring non-trivial modifications to existing C programs (e.g., Cyclone), changing the memory management model of C to use garbage collection (e.g., CCured), and excessive performance overheads. In this paper, we present a new approach that addresses these problems. Our approach operates via source code transformation and combines efficient data-structures with simple, localized optimizations to obtain good performance.
Checking memory safety with Blast
- Proceedings, 8th International Conference on Fundamental Approaches to Software Engineering (FASE), volume 3442 of LNCS
, 2005
"... Abstract. Blast is an automatic verification tool for checking temporal safety properties of C programs. Given a C program and a temporal safety property, Blast statically proves that either the program satisfies the safety property or the program has an execution trace that exhibits a violation of ..."
Abstract
-
Cited by 18 (1 self)
- Add to MetaCart
Abstract. Blast is an automatic verification tool for checking temporal safety properties of C programs. Given a C program and a temporal safety property, Blast statically proves that either the program satisfies the safety property or the program has an execution trace that exhibits a violation of the property. Blast constructs, explores, and refines abstractions of the program state space based on lazy predicate abstraction and interpolation-based predicate discovery. We show how Blast can be used to statically prove memory safety for C programs. We take a two-step approach. First, we use CCured, a type-based memory safety analyzer, to annotate with run-time checks all program points that cannot be proved memory safe by the type system. Second, we use Blast to remove as many of the run-time checks as possible (by proving that these checks never fail), and to generate for the remaining run-time checks execution traces that witness them fail. Our experience shows that Blast can remove many of the run-time checks added by CCured and provide useful information to the programmer about many of the remaining checks. 1

