Eliminating Redundant Bounds Checks in Dynamic Buffer Overflow Detection Using Weakest Preconditions
Spatial errors (e.g. buffer overflows) continue to be one of the dominant threats to software reliability and security in C/C+ programs. Presently, the software industry typically enforces spatial memory safety by instrumentation. Due to high overheads incurred in bounds checking at runtime, many program inputs cannot be exercised, causing some input specific spatial errors to go undetected in today's commercial software. This paper introduces a new compile time approach for reducing bounds checking overheads based on the notion of weakest precondition (WP) The basic idea is to guard a bounds check at a pointer dereference inside a loop, where the WP based guard is hoisted outside the loop, so that its falsehood implies the absence of out of bounds errors at the dereference, thereby avoiding the corresponding bounds check inside the loop. This WP based approach is applicable to any spatial error detection approach (in software or hardware or both) To evaluate the effectiveness of our approach, we take SoftBound, a compile time tool with an open source implementation in low level virtual machine (LLVM) as our baseline. SoftBound adopts a pointer based checking scheme with disjoint metadata, making it a state of the art tool in providing compatible and complete spatial safety for C. Our new tool, called WPBound, is a refined version of SoftBound, also implemented in LLVM, by incorporating our WP based compiler approach comprising both intra and interprocedural optimizations. For a set of 20 C benchmarks selected from SPEC and MiBench,WPBound reduces the average runtime overhead of SoftB ound from 77% to 47% (by a reduction of 39% with small code size increases.
IEEE Transactions on Reliability