Abstract:C is a dominant programming language for implementing system and low-level embedded software. Unfortunately, the unsafe nature of its low-level control of memory often leads to memory errors. Dynamic analysis has been widely used to detect memory errors at runtime. However, existing monitoring algorithms for dynamic analysis are not yet satisfactory as they cannot deterministically and completely detect some types of errors, e.g., segment confusion errors, sub-object overflows, use-after-frees and memory leaks. We propose a new monitoring algorithm, namely Smatus , short for smart status , that improves memory safety by performing comprehensive dynamic analysis. The key innovation is to maintain at runtime a small status node for each memory object. A status node records the status value and reference count of an object, where the status value denotes the liveness and segment type of this object, and the reference count tracks the number of pointer variables pointing to this object. Smatus maintains at runtime a pointer metadata for each pointer variable, to record not only the base and bound of a pointer’s referent but also the address of the referent’s status node. All the pointers pointing to the same referent share the same status node in their pointer metadata. A status node is smart in the sense that it is automatically deleted when it becomes useless (indicated by its reference count reaching zero). To the best of our knowledge, Smatus represents the most comprehensive approach of its kind. We have evaluated Smatus by using a large set of programs including the NIST Software Assurance Reference Dataset, MSBench, MiBench, SPEC and stress testing benchmarks. In terms of effectiveness (detecting different types of memory errors), Smatus outperforms state-of-the-art tools, Google’s AddressSanitizer, SoftBoundCETS and Valgrind, as it is capable of detecting more errors. In terms of performance (the time and memory overheads), Smatus outperforms SoftBoundCETS and Valgrind in terms of both lower time and memory overheads incurred, and is on par with AddressSanitizer in terms of the time and memory overhead tradeoff made (with much lower memory overheads incurred).

A Dynamic Detection Method To C/C Plus Plus Programs Memory Vulnerabilities Based On Pointer Analysis

A Dynamic Detection Method to C/C++ Programs Memory Vulnerabilities Based on Pointer Analysis

Securing c programs by dynamic type checking

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Tools to Make C Programs Safe: a Deeper Study

Invalid Pointer Dereferences Detection for CPS Software Based on Extended Pointer Structures

A Smart Status Based Monitoring Algorithm for the Dynamic Analysis of Memory Safety

Dynamic Memory Testing Based on Source Code Instrumentation on Linux Platform

A Source-Level Instrumentation Framework for the Dynamic Analysis of Memory Safety

Memory errors prevention technology for C/C++ program based on probability.

Mpchecker: Use-After-Free Vulnerabilities Protection Based on Multi-Level Pointers

Memory Errors Prevention Technology for C/C++ Program Based on Probability

SCAD: Controlled Memory Allocation Analysis and Detection

DangKiller: Eliminating Dangling Pointers Efficiently Via Implicit Identifier

TsmartGP: a tool for finding memory defects with pointer analysis

A Dynamic Approach to Detecting, Eliminating and Fixing Memory Leaks

A Parallel Memory Defect Detection Method Based on Sparse-Value-Flow Graph

Detecting Memory-Related Bugs by Tracking Heap Memory Management of C++ Smart Pointers

A Projection-Based Approach for Memory Leak Detection

Software Vulnerability Detection Method Based on the Lexical and Syntax Analysis

Simber: Eliminating Redundant Memory Bound Checks Via Statistical Inference