Document Type
Conference Paper
Publication Date
8-2016
Publication Source
2016 IEEE International Conference on Software Quality, Reliability and Security
Abstract
Memory errors such as buffer overruns are notorious security vulnerabilities. There has been considerable interest in having a compiler to ensure the safety of compiled code either through static verification or through instrumented runtime checks. While certifying compilation has shown much promise, it has not been practical, leaving code instrumentation as the next best strategy for compilation. We term such compilers Memory Error Sanitization Compilers (MESCs). MESCs are available as part of GCC, LLVM and MSVC suites. Due to practical limitations, MESCs typically apply instrumentation indiscriminately to every memory access, and are consequently prohibitively expensive and practical to only small code bases. This work proposes a methodology that applies state-of-the-art static analysis techniques to eliminate unnecessary runtime checks, resulting in more efficient and scalable defenses. The methodology was implemented on LLVM's Safecode, Integer Overflow, and Address Sanitizer passes, using static analysis of Frama-C and Codesurfer. The benchmarks demonstrate an improvement in runtime performance that makes incorporation of runtime checks a viable option for defenses.
Inclusive pages
323–334
ISBN/ISSN
9781509041275
Document Version
Postprint
Copyright
Copyright © 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Publisher
Institute of Electrical and Electronics Engineers
Peer Reviewed
yes
eCommons Citation
Gjomemo, Rigel; Phung, Phu Huu; Ballou, Edmund; Namjoshi, Kedar S.; Venkatakrishnan, V. N.; and Zuck, Lenore, "Leveraging Static Analysis Tools for Improving Usability of Memory Error Sanitization Compilers" (2016). Computer Science Faculty Publications. 141.
https://ecommons.udayton.edu/cps_fac_pub/141
Comments
The document available for download is the authors' accepted manuscript, provided in compliance with the publisher's policy on self-archiving. To read the version of record, use the DOI provided.
Permission documentation on file.