Concept

Memory safety

Publications associées (24)

Comprehensive Memory Safety Validation: An Alternative Approach to Memory Safety

Comprehensive memory safety validation identifies the memory objects whose accesses provably comply with all classes of memory safety, protecting them from memory errors elsewhere at low overhead. We assess the breadth and depth of comprehensive memory saf ...

Ieee Computer Soc2024

Preventing Use-After-Free Attacks with Fast Forward Allocation

Sanidhya Kashyap, Jungwon Lim

Memory-unsafe languages are widely used to implement critical systems like kernels and browsers, leading to thousands of memory safety issues every year. A use-after-free bug is a temporal memory error where the program accidentally visits a freed memory l ...

USENIX ASSOC2021

Admissibility of Uncertain Injections in Quadratic Algebraic Systems

Jean-Yves Le Boudec, Cong Wang, Eleni Stai

We study the admissibility problem in multivariate algebraic systems, such as ac electrical networks, where the power injection is quadratic in the state. The goal of such systems is to ensure that the state stays in some security set (e.g., magnitudes of ...

2021

Safe Initialization of Objects

Martin Odersky, Fengyun Liu, Paolo Giosuè Giarrusso, Ondrej Lhoták

Every newly created object goes through several initialization states: starting from a state where all fields are uninitialized until all of them are assigned. Any operation on the object during its initialization process, which usually happens in the cons ...

2020

A Type-and-Effect System for Object Initialization

Martin Odersky, Fengyun Liu, Paolo Giosuè Giarrusso, Ondrej Lhoták

ASSOC COMPUTING MACHINERY2020

Safe initialization of objects

Fengyun Liu

The inception of object-oriented programming introduces a category of bugs related to object construction: initialization errors. Every newly created object goes through several initialization states: starting from a state where all fields are uninitialize ...

EPFL2020

RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization

Mathias Josef Payer, Duo Xu

Analyzing the security of closed source binaries is currently impractical for end-users, or even developers who rely on third-party libraries. Such analysis relies on automatic vulnerability discovery techniques, most notably fuzzing with sanitizers enable ...

IEEE COMPUTER SOC2020

SoK: Shining Light on Shadow Stacks

Mathias Josef Payer, Xiangyu Zhang

Control-Flow Hijacking attacks are the dominant attack vector against C/C++ programs. Control-Flow Integrity (CFI) solutions mitigate these attacks on the forward edge, i.e., indirect calls through function pointers and virtual calls. Protecting the backwa ...

IEEE COMPUTER SOC2019

System Support for Efficient Replication in Distributed Systems

Dragos-Adrian Seredinschi

Current online applications, such as search engines, social networks, or file sharing services, execute across a distributed network of machines. They provide non-stop services to their users despite failures in the underlying network. To achieve such a hi ...

EPFL2019

Initialization patterns in Dotty

Martin Odersky, Fengyun Liu

Safe object initialization is important to avoid a category of runtime errors in programming languages. In this paper, we provide a case study of the initialization patterns on the Dotty compiler. In particular, we find that calling dynamic-dispatching met ...

2018

Detailed Heap Profiling

James Richard Larus, Stuart Anthony Byma

Modern software systems heavily use the memory heap. As systems grow more complex and compute with increasing amounts of data, it can be difficult for developers to understand how their programs actually use the bytes that they allocate on the heap and whe ...

ACM2018

LMS-Verify: Abstraction without Regret for Verified Systems Programming’

Tiark Rompf, Nada Amin

Performance critical software is almost always developed in C, as programmers do not trust high-level languages to deliver the same reliable performance. This is bad because low-level code in unsafe languages attracts security vulnerabilities and because d ...

Assoc Computing Machinery2017

Algorithmic Resource Verification

Ravichandhran Kandhadai Madhavan

Static estimation of resource utilisation of programs is a challenging and important problem with numerous applications. In this thesis, I present new algorithms that enable users to specify and verify their desired bounds on resource usage of functional p ...

EPFL2017

SMT-Based Checking of Predicate-Qualified Types for Scala

Viktor Kuncak, Georg Stefan Schmid

We present qualified types for Scala, a form of refinement types adapted to the Scala language. Qualified types allow users to refine base types and classes using predicate expressions. We implemented a type checker for qualified types that is embedded in ...

Assoc Computing Machinery2016

Improving systems software security through program analysis and instrumentation

Volodymyr Kuznetsov

Security and reliability bugs are prevalent in systems software. Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management and type safety to programmers. This invites bugs that cause cra ...

EPFL2016

SABRes: Atomic Object Reads for In-Memory Rack-Scale Computing

Babak Falsafi, Edouard Bugnion, Boris Robert Grot, Alexandros Daglis, Stanko Novakovic, Dmitrii Ustiugov

Modern in-memory services rely on large distributed object stores to achieve the high scalability essential to service thousands of requests concurrently. The independent and unpredictable nature of incoming requests results in random accesses to the objec ...

Ieee2016

Asynchronous memory access chaining

Babak Falsafi, Boris Robert Grot, Yusuf Onur Koçberber

In-memory databases rely on pointer-intensive data structures to quickly locate data in memory. A single lookup operation in such data structures often exhibits long-latency memory stalls due to dependent pointer dereferences. Hiding the memory latency by ...

2015

Techniques for Detection, Root Cause Diagnosis, and Classification of In-Production Concurrency Bugs

Baris Can Cengiz Kasikci

Concurrency bugs are at the heart of some of the worst bugs that plague software. Concurrency bugs slow down software development because it can take weeks or even months before developers can identify and fix them. In-production detection, root cause ...

EPFL2015

Surgical Precision JIT Compilers

Tiark Rompf, Hassan Chafi

Just-in-time (JIT) compilation of running programs provides more optimization opportunities than offline compilation. Modern JIT compilers, such as those in virtual machines like Oracle's HotSpot for Java or Google's V8 for JavaScript, rely on dynamic prof ...

Assoc Computing Machinery2014

Execution Synthesis: A Technique for Automating the Debugging of Software

Cristian Zamfir

Debugging real systems is hard, requires deep knowledge of the target code, and is time-consuming. Bug reports rarely provide sufficient information for debugging, thus forcing developers to turn into detectives searching for an explanation of how the prog ...

EPFL2013