WPBOUND: Enforcing Spatial Memory Safety Efficiently at Runtime with Weakest Preconditions

Abstract

Abstract-Spatial errors (e.g., buffer overflows) continue to be one of the dominant threats to software reliability and security in C/C++ programs. Presently, the software industry typically enforces spatial memory safety by instrumentation. Due to high overheads incurred in bounds checking at runtime, many program inputs cannot be exercised, causing some input-specific spatial errors to go undetected in today's commercial software.This paper introduces a new compile-time optimisation for reducing bounds checking overheads based on the notion of Weakest Precondition (WP). The basic idea is to guard a bounds check at a pointer dereference inside a loop, where the WPbased guard is hoisted outside the loop, so that its falsehood implies the absence of out-of-bounds errors at the dereference, thereby avoiding the corresponding bounds check inside the loop. This WP-based optimisation is applicable to any spatial-error detection approach (in software or hardware or both).To evaluate the effectiveness of our optimisation, we take SOFTBOUND, a compile-time tool with an open-source implementation in LLVM, as our baseline. SOFTBOUND adopts a pointerbased checking approach with disjoint metadata, making it a state-of-the-art tool in providing compatible and complete spatial safety for C. Our new tool, called WPBOUND, is a refined version of SOFTBOUND, also implemented in LLVM, by incorporating our WP-based optimisation. For a set of 12 SPEC C benchmarks evaluated, WPBOUND reduces the average runtime overhead of SOFTBOUND from 71% to 45% (by a reduction of 37%), with small code size increases.

Bogo

“…llvm-mpx is applied at last. The same convention of using all possible optimizations before the instrumentation was adopted in SoftBound [41] and others [38,42,56,69]. We investigated the high runtime overhead of icc-mpx and gcc-mpx.…”

“…(3) Bound check consolidation: if it can statically calculate the range of the access in a loop or a vectorized code, it consolidates the checks into one check and pays the overhead only once. This is a very simple form of optimization proposed in Gupta's work [28] and WPBound [68].…”

“…Since the above optimizations are safe for spatial memory safety [28,68], they do not compromise BOGO's temporal memory safety guarantee. For example, optimization (1) only deals with local arrays or globals, not the heap objects that are the target of BOGO.…”

Risk Assessment of Buffer "Heartbleed" Over-Read Vulnerabilities

“…2), then memcpy will copy such data to the intermediate buffer which will be then sent to the attacker. Note that existing approaches on bounds checking [7], [8], [9] does not really handle this type of information leak, because they only check memory access at the end of the buffer. The second type is to steal information that are stored out of the current buffer.…”

“…These techniques have been implemented in many compilers and systems, but they are not applicable to the over-read issue. There is also a large volume of research on direct bound checking (e.g., [7], [8], [9]) and safe type system retrofitting (e.g., [10], [11]). Bounds checking and safe type system retrofitting can mitigate the over-read issue, but few is widely adopted due to either excessive runtime overhead, expensive cost of manual work, or insufficient mitigation in practice.…”