GWP-ASan: Sampling-Based Detection of Memory-Safety Bugs in Production
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2023
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866917567005720576 |
|---|---|
| author | Serebryany, Kostya Kennelly, Chris Phillips, Mitch Denton, Matt Elver, Marco Potapenko, Alexander Morehouse, Matt Tsyrklevich, Vlad Holler, Christian Lettner, Julian Kilzer, David Brandt, Lander |
| author_facet | Serebryany, Kostya Kennelly, Chris Phillips, Mitch Denton, Matt Elver, Marco Potapenko, Alexander Morehouse, Matt Tsyrklevich, Vlad Holler, Christian Lettner, Julian Kilzer, David Brandt, Lander |
| contents | Despite the recent advances in pre-production bug detection, heap-use-after-free and heap-buffer-overflow bugs remain the primary problem for security, reliability, and developer productivity for applications written in C or C++, across all major software ecosystems. Memory-safe languages solve this problem when they are used, but the existing code bases consisting of billions of lines of C and C++ continue to grow, and we need additional bug detection mechanisms.
This paper describes a family of tools that detect these two classes of memory-safety bugs, while running in production, at near-zero overhead. These tools combine page-granular guarded allocation and low-rate sampling. In other words, we added an "if" statement to a 36-year-old idea and made it work at scale.
We describe the basic algorithm, several of its variants and implementations, and the results of multi-year deployments across mobile, desktop, and server applications. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2311_09394 |
| institution | arXiv |
| publishDate | 2023 |
| record_format | arxiv |
| spellingShingle | GWP-ASan: Sampling-Based Detection of Memory-Safety Bugs in Production Serebryany, Kostya Kennelly, Chris Phillips, Mitch Denton, Matt Elver, Marco Potapenko, Alexander Morehouse, Matt Tsyrklevich, Vlad Holler, Christian Lettner, Julian Kilzer, David Brandt, Lander Software Engineering Programming Languages Despite the recent advances in pre-production bug detection, heap-use-after-free and heap-buffer-overflow bugs remain the primary problem for security, reliability, and developer productivity for applications written in C or C++, across all major software ecosystems. Memory-safe languages solve this problem when they are used, but the existing code bases consisting of billions of lines of C and C++ continue to grow, and we need additional bug detection mechanisms. This paper describes a family of tools that detect these two classes of memory-safety bugs, while running in production, at near-zero overhead. These tools combine page-granular guarded allocation and low-rate sampling. In other words, we added an "if" statement to a 36-year-old idea and made it work at scale. We describe the basic algorithm, several of its variants and implementations, and the results of multi-year deployments across mobile, desktop, and server applications. |
| title | GWP-ASan: Sampling-Based Detection of Memory-Safety Bugs in Production |
| topic | Software Engineering Programming Languages |
| url | https://arxiv.org/abs/2311.09394 |