Abstract:Existing tools for the automated detection of memory corruption bugs are not very effective in practice. They typically recognize only standard memory management (MM) APIs (e.g., malloc and free) and assume a naive paired-use model—an allocator is followed by a specific deallocator. However, we observe that programmers very often design their own MM functions and that these functions often manifest two major characteristics: (1) Custom allocator functions perform multi-object or nested allocation which then requires structure-aware deallocation functions. (2) Custom allocators and deallocators follow an unpaired-use model. A more effective detection thus needs to adapt those characteristics and capture memory bugs related to non-standard MM behaviors. In this paper, we present a MM function aware memory bug detection technique by introducing the concept of structure-aware and object-centric Memory Operation Synopsis (MOS). A MOS abstractly describes the memory objects of a given MM function, how they are managed by the function, and their structural relations. By utilizing MOS, a bug detection could explore much less code but is still capable of handling multi-object or nested allocations and does not rely on the paired-use model. In addition, to extensively find MM functions and automatically generate MOS for them, we propose a new identification approach that combines natural language processing (NLP) and data flow analysis, which enables the efficient and comprehensive identification of MM functions, even in very large code bases. We implement a MOS-enhanced memory bug detection system, Goshawk, to discover memory bugs caused by complex and custom MM behaviors. We applied Goshawk to well-tested and widely-used open source projects including OS kernels, server applications, and IoT SDKs. Goshawk outperforms the state-of-the-art data flow analysis driven bug detection tools by an order of magnitude in analysis speed and the number of accurately identified MM functions, reports the discovered bugs with a developer-friendly, MOS based description, and successfully detects 92 new double-free and use-after-free bugs.

Detecting Memory-Related Bugs by Tracking Heap Memory Management of C++ Smart Pointers

TsmartGP: a tool for finding memory defects with pointer analysis

Static Analysis Framework for Detecting Use-After-Free Bugs in C++

Detecting Exception Handling Bugs in C++ Programs.

AddressWatcher: Sanitizer-Based Localization of Memory Leak Fixes

Goshawk: Hunting Memory Corruptions Via Structure-Aware and Object-Centric Memory Operation Synopsis

Identifying Valuable Pointers in Heap Data

Multi-sensitive static method of detecting null pointer dereference bug

Safe Memory-Leak Fixing for C Programs

rCanary: Detecting Memory Leaks Across Semi-automated Memory Management Boundary in Rust

Runtime Biased Pointer Reuse Analysis and Its Application to Energy Efficiency

FREEWILL: Automatically Diagnosing Use-after-free Bugs via Reference Miscounting Detection on Binaries

Pointer life cycle types for lock-free data structures with memory reclamation

Necessity and Capability of Flow, Context, Field and Quasi Path Sensitive Points-to Analysis

MetaTableLite - an Efficient Metadata Management Scheme for Tagged-Pointer-Based Spatial Safety.

DangKiller: Eliminating Dangling Pointers Efficiently Via Implicit Identifier

Dynamically Validating Static Memory Leak Warnings

Automatically Validating Static Memory Leak Warnings for C / C + + Programs

Scalable and Extensible Static Memory Safety Analysis with Summary over Access Path

Learning a Static Bug Finder from Data

SCAD: Controlled Memory Allocation Analysis and Detection