3 ms·
EDIT: Apparently CHERI can handle this scenario, please ignore the rest of the comment Memory safety is not a binary choice. Consider this typical structure:
by PhilipRoman 3y ago
EDIT: Apparently CHERI can handle this scenario, please ignore the rest of the comment
Memory safety is not a binary choice. Consider this typical structure:
struct buffer {
char *data;
size_t capacity;
size_t length;
}
In fact it doesn't even have to be C, you could write it in Java, Python, etc. Lets say you decide to reuse such a buffer multiple times. From the C semantics point of view, there is nothing wrong with accessing elements past length. But it can easily lead to a heartbleed style vulnerability. There is probably some escape hatch for CHERI to mark memory as uninitialized, but I'm not very familiar with it. In Rust you can probably give out slices which will ensure bounds checking (or eliminate it if possible). The only correct way towards safety is languages which enable the programmer to add additional restrictions, like Rust or Frama-C.
Anyway, this is mostly just theoretical musing, in practice CHERI will catch lots of issues. But I don't think it is correct to call it "memory safety".
- vzaliva 3y agoIn CHERI, the `data` pointer in your example is not merely a 64-bit pointer (assuming ARM Morello architecture) but a special 128-bit data structure called a `capability`, which encodes within it the bounds of the memory block allocated to it. The hardware will prevent any out-of-bounds access, even if you manage to bypass any C language type checks, for example, by using inline assembly. So, this offers a pretty strong level of memory protection.
- PhilipRoman 3y agoYes, but the capability will be enforcing the bound w.r.t "capacity", not "length" as that is the allocated size. From CHERI's point of view "length" is just some random user defined variable with no effect on bounds checks.
- Peter_Sewell 3y agoIf you want to narrow the bounds of `data` on reuse, you can do easily do that in CHERI C (you'd need to also keep the larger capability somewhere to rederive the `data` capability from, either in this struct or elsewhere, depending where the allocation come from).
- PhilipRoman 3y agoOh that is great news, I was not aware that CHERI was this powerful. Interesting if this could be abused by JIT compilers to provide free runtime bounds checks, kind of like the free null pointer checks done by catching SEGV.