Abstract:C is a dominant programming language for implementing system and low-level embedded software. Unfortunately, the unsafe nature of its low-level control of memory often leads to memory errors. Dynamic analysis has been widely used to detect memory errors at runtime. However, existing monitoring algorithms for dynamic analysis are not yet satisfactory as they cannot deterministically and completely detect some types of errors, e.g., segment confusion errors, sub-object overflows, use-after-frees and memory leaks. We propose a new monitoring algorithm, namely Smatus , short for smart status , that improves memory safety by performing comprehensive dynamic analysis. The key innovation is to maintain at runtime a small status node for each memory object. A status node records the status value and reference count of an object, where the status value denotes the liveness and segment type of this object, and the reference count tracks the number of pointer variables pointing to this object. Smatus maintains at runtime a pointer metadata for each pointer variable, to record not only the base and bound of a pointer’s referent but also the address of the referent’s status node. All the pointers pointing to the same referent share the same status node in their pointer metadata. A status node is smart in the sense that it is automatically deleted when it becomes useless (indicated by its reference count reaching zero). To the best of our knowledge, Smatus represents the most comprehensive approach of its kind. We have evaluated Smatus by using a large set of programs including the NIST Software Assurance Reference Dataset, MSBench, MiBench, SPEC and stress testing benchmarks. In terms of effectiveness (detecting different types of memory errors), Smatus outperforms state-of-the-art tools, Google’s AddressSanitizer, SoftBoundCETS and Valgrind, as it is capable of detecting more errors. In terms of performance (the time and memory overheads), Smatus outperforms SoftBoundCETS and Valgrind in terms of both lower time and memory overheads incurred, and is on par with AddressSanitizer in terms of the time and memory overhead tradeoff made (with much lower memory overheads incurred).

Memory Errors Prevention Technology for C/C++ Program Based on Probability

Memory errors prevention technology for C/C++ program based on probability.

Memory Safety Based on Probabilistic Memory Allocation

Research On Memory Security Based On Probability

A Dynamic Detection Method To C/C Plus Plus Programs Memory Vulnerabilities Based On Pointer Analysis

A Dynamic Detection Method to C/C++ Programs Memory Vulnerabilities Based on Pointer Analysis

Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects

Physical Memory Attacks and a Memory Safe Management System for Memory Defense

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

On-Demand Proactive Defense Against Memory Vulnerabilities

PACSafe: Leveraging ARM Pointer Authentication for Memory Safety in C/C++

Mpchecker: Use-After-Free Vulnerabilities Protection Based on Multi-Level Pointers

CUP: Comprehensive User-Space Protection for C/C++

ShadowBound: Efficient Heap Memory Protection Through Advanced Metadata Management and Customized Compiler Optimization

Detection, exploitation and mitigation of memory errors

Randomized C/C++ dynamic memory allocator

A Smart Status Based Monitoring Algorithm for the Dynamic Analysis of Memory Safety

Simber: Eliminating Redundant Memory Bound Checks Via Statistical Inference

Pointing in the Right Direction - Securing Memory Accesses in a Faulty World

Balancing the Lifetime and Storage Overhead on Error Correction for Phase Change Memory

Memory Confidentiality and Integrity Protection Technology