4 ms·

Practical memory safety for C (2011) [pdf]

13 points by _pdp_ 11y ago

nickpsecurity 11y ago
I didn't have this one and it covers a lot of ground. Thanks for the submission.
- kjs3 11y ago
  I wouldn't mind seeing other ones you have on the subject.
  - nickpsecurity 11y ago
    Unfortunately, I think I lost a bunch of those. Too much stuff to track. I did dig up these I found over past year or so. Complete translation of unsafe native code to safe bytecode 2004 Alliet and Megacz http://www.megacz.com/research/papers/nestedvm.ivme04.pdf http://www.megacz.com/research/papers/nestedvm.ivme04.pdf The memory pool system - thirty person-years of memory management development goes open source Brooksby and Barnes http://www.ravenbrook.com/project/mps/doc/2002-01-30/ismm2002-paper/ismm2002-a4.pdf http://www.ravenbrook.com/project/mps/doc/2002-01-30/ismm200... Cyclone Programming Language https://en.wikipedia.org/wiki/Cyclone_%28programming_language%29 https://en.wikipedia.org/wiki/Cyclone_%28programming_languag... CCured - type-safe retrofitting of legacy code http://www.cs.berkeley.edu/~necula/Papers/ccured_popl02.pdf http://www.cs.berkeley.edu/~necula/Papers/ccured_popl02.pdf SoftBound - highly compatible and complete spatial memory safety for C http://www.cis.upenn.edu/acg/papers/pldi09_softbound.pdf http://www.cis.upenn.edu/acg/papers/pldi09_softbound.pdf Watchdog - hardware for safe and secure manual memory management & full mem safety http://www.cs.rutgers.edu/~santosh.nagarakatte/papers/isca12_watchdog.pdf http://www.cs.rutgers.edu/~santosh.nagarakatte/papers/isca12... SAFEcode - enforcing alias analysis for weakly typed languages http://llvm.org/pubs/2006-05-12-PLDI-SAFECode.pdf http://llvm.org/pubs/2006-05-12-PLDI-SAFECode.pdf Architectural support for a memory-safe C abstract machine http://www.cl.cam.ac.uk/~dc552/papers/asplos15-memory-safe-c.pdf http://www.cl.cam.ac.uk/~dc552/papers/asplos15-memory-safe-c... Those are the one's C focused. Much of my collection is about non-C languages given it's inherently hard to protect or prove correct. Most good finds over past year or so are hardware enhancement to improve safety/security. Also, the SCOOP memory model & associated research papers (Google them) are smashing concurrency problems to pieces. Worth porting over to C if possible. Then SVA-OS for hardware interface. CompCert modifications for compiler. Maybe some linker work. Big picture mostly done at that point. :)
    - kjs3 11y ago
      I appreciate you digging those up. Thanks.
      - nickpsecurity 11y ago
        You're welcome. :)

13 points by _pdp_ 11y ago

nickpsecurity 11y ago

I didn't have this one and it covers a lot of ground. Thanks for the submission.

kjs3 11y ago
I wouldn't mind seeing other ones you have on the subject.
- nickpsecurity 11y ago
  Unfortunately, I think I lost a bunch of those. Too much stuff to track. I did dig up these I found over past year or so. Complete translation of unsafe native code to safe bytecode 2004 Alliet and Megacz http://www.megacz.com/research/papers/nestedvm.ivme04.pdf http://www.megacz.com/research/papers/nestedvm.ivme04.pdf The memory pool system - thirty person-years of memory management development goes open source Brooksby and Barnes http://www.ravenbrook.com/project/mps/doc/2002-01-30/ismm2002-paper/ismm2002-a4.pdf http://www.ravenbrook.com/project/mps/doc/2002-01-30/ismm200... Cyclone Programming Language https://en.wikipedia.org/wiki/Cyclone_%28programming_language%29 https://en.wikipedia.org/wiki/Cyclone_%28programming_languag... CCured - type-safe retrofitting of legacy code http://www.cs.berkeley.edu/~necula/Papers/ccured_popl02.pdf http://www.cs.berkeley.edu/~necula/Papers/ccured_popl02.pdf SoftBound - highly compatible and complete spatial memory safety for C http://www.cis.upenn.edu/acg/papers/pldi09_softbound.pdf http://www.cis.upenn.edu/acg/papers/pldi09_softbound.pdf Watchdog - hardware for safe and secure manual memory management & full mem safety http://www.cs.rutgers.edu/~santosh.nagarakatte/papers/isca12_watchdog.pdf http://www.cs.rutgers.edu/~santosh.nagarakatte/papers/isca12... SAFEcode - enforcing alias analysis for weakly typed languages http://llvm.org/pubs/2006-05-12-PLDI-SAFECode.pdf http://llvm.org/pubs/2006-05-12-PLDI-SAFECode.pdf Architectural support for a memory-safe C abstract machine http://www.cl.cam.ac.uk/~dc552/papers/asplos15-memory-safe-c.pdf http://www.cl.cam.ac.uk/~dc552/papers/asplos15-memory-safe-c... Those are the one's C focused. Much of my collection is about non-C languages given it's inherently hard to protect or prove correct. Most good finds over past year or so are hardware enhancement to improve safety/security. Also, the SCOOP memory model & associated research papers (Google them) are smashing concurrency problems to pieces. Worth porting over to C if possible. Then SVA-OS for hardware interface. CompCert modifications for compiler. Maybe some linker work. Big picture mostly done at that point. :)
  - kjs3 11y ago
    I appreciate you digging those up. Thanks.
    - nickpsecurity 11y ago
      You're welcome. :)