Detection method and device for heap overflow and electronic equipment
By randomly inserting and monitoring canary values in the heap manager using pseudo-random generators in the heap manager, the problems of low security and inability to detect heap block overflow in the prior art are solved, and more efficient heap overflow detection and protection are achieved.
Patent Information
- Application Number
- CN202411795436.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-06
- Publication Date
- 2025-04-25
AI Technical Summary
The existing heap manager has location predictability when detecting stack overflows, which reduces security and cannot detect attacks on data overflows on heap blocks to modify the heap structure.
The pseudo-random generator randomly decides whether to insert a canary in the heap block and randomly determines its position and value, and records it in the heap Canary table. When using heap blocks, the consistency of canary values is detected to identify heap overflow.
It improves the security of the heap manager, enhances the detection ability of heap overflow attacks, and is difficult to predict the location of the canary by the attacker, reducing the possibility of the attack success.
Smart Images
Figure CN119883693A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a method, device and electronic device for detecting heap overflow. Background Art
[0002] Existing heap managers mainly use stack canary technology to place fixed values before and after the stack to detect stack overflow. Due to the predictability of the position, placing values at fixed positions in the stack is easy to be predicted and bypassed by attackers, which reduces security. Moreover, setting canaries only at the beginning or end of the stack limits the scope of memory overflow detection and cannot detect attacks on heap blocks that modify the heap structure due to data overflow.
[0003] As a result, how to improve the security of the heap manager becomes a technical problem that needs to be solved urgently. Summary of the invention
[0004] Embodiments of the present application provide a method, device, and electronic device for detecting a heap overflow, which are used to improve the security of a heap manager.
[0005] In a first aspect, an embodiment of the present application provides a method for detecting a heap overflow, which is applied to a heap manager and includes:
[0006] Receiving a memory allocation request from an application and determining a heap block of a size currently required by the application;
[0007] Randomly decide whether to insert a canary into the heap block by using a pseudo-random generator;
[0008] If yes, randomly determine the position of the canary in the heap block by using the pseudo-random generator, and randomly generate a first canary value for the heap block;
[0009] Allocating the heap block to the application, and inserting the first canary value at the position of the heap block;
[0010] Recording the identifier of the heap block, the position and the first canary value in a table having a preset data structure;
[0011] In the process of using the heap block, detecting whether a second canary value monitored at the position of the heap block is consistent with a first canary value corresponding to the position found in the table according to an identifier of the heap block;
[0012] If they are inconsistent, it indicates that a heap overflow occurs in the heap block.
[0013] In one possible implementation, the randomly deciding whether to insert a canary into the heap block by using a pseudo-random generator includes:
[0014] Generate a random number through the pseudo-random generator, the value range of the random number is within [0,1);
[0015] If the random number is less than a preset threshold, it is decided to insert a canary into the heap block.
[0016] In one possible implementation manner, after recording the identifier of the heap block, the position, and the first canary value in a table having a preset data structure, the method further includes:
[0017] If a memory release request is received from the application, verify whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block;
[0018] If they are inconsistent, it indicates that the canary value inserted into the heap block is changed, triggering a security warning.
[0019] In one possible implementation, after verifying whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block, the method further includes:
[0020] If they are consistent, the heap block is safely released.
[0021] In a second aspect, an embodiment of the present application provides a detection device for heap overflow, which is applied to a heap manager, including:
[0022] A first determining unit, configured to receive a memory allocation request from an application program and determine a heap block of a size currently required by the application program;
[0023] A decision unit, configured to randomly decide whether to insert a canary into the heap block by using a pseudo-random generator;
[0024] The second determining unit, if yes, randomly determines the position of the canary in the heap block by using the pseudo-random generator, and randomly generates a first canary value for the heap block;
[0025] an allocating unit, configured to allocate the heap block to the application and insert the first canary value into the position of the heap block;
[0026] a recording unit, configured to record the identifier of the heap block, the position and the first canary value in a table having a preset data structure;
[0027] A detection unit is used to detect whether a second canary value monitored at the position of the heap block is consistent with a first canary value corresponding to the position found in the table according to an identifier of the heap block during the use of the heap block; if they are inconsistent, it indicates that a heap overflow has occurred in the heap block.
[0028] In one possible implementation manner, the decision unit is specifically configured to:
[0029] Generate a random number through the pseudo-random generator, the value range of the random number is within [0,1);
[0030] If the random number is less than a preset threshold, it is decided to insert a canary into the heap block.
[0031] In one possible implementation manner, after the recording unit records the identifier of the heap block, the position, and the canary value in a table having a preset data structure, the device further includes a verification unit, wherein the verification unit is specifically configured to:
[0032] If a memory release request is received from the application, verify whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block;
[0033] If they are inconsistent, it indicates that the canary value inserted into the heap block is changed, triggering a security warning.
[0034] In one possible implementation manner, the verification unit is further configured to:
[0035] If they are consistent, the heap block is safely released.
[0036] In a third aspect, an embodiment of the present application provides an electronic device, including:
[0037] Memory, used to store computer programs;
[0038] The processor is used to implement any of the method steps described above when executing the computer program stored in the memory.
[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute any of the method steps described above.
[0040] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes: a computer program code, and when the computer program code runs on a computer, the computer executes any one of the methods described above.
[0041] The beneficial effects of the embodiments of the present application are as follows:
[0042] The embodiment of the present application provides a method, device and electronic device for detecting heap overflow. First, an application requests memory allocation, and a heap manager receives the memory allocation request from the application and determines a heap block of the size required by the application. Exemplarily, the application requests the allocation of a heap block of 10 bytes. Then, a pseudo-random generator is used to randomly decide whether to insert a canary in the heap block. If yes, the position of the canary in the heap block and the corresponding first canary value are randomly determined by the pseudo-random generator. Then, the heap block is allocated to the application, and the first canary value is inserted at the randomly determined position of the heap block. Then, the identifier, position and first canary value of the heap block are recorded in a table with a preset data structure. Then, in the process of using the heap block, it is detected whether the second canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block. If they are inconsistent, it indicates that a heap overflow has occurred in the heap block.
[0043] That is to say, in the process of using heap blocks, the heap manager can monitor the canary value at the corresponding position by randomly selecting a position in the heap block and randomly inserting the canary value, thereby detecting potential heap overflow attacks; due to the randomness and dynamics of the entire method, it is difficult for attackers to predict the specific position of the canary, thereby improving the security of the heap manager. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] Figure 1 A flow chart of one of the methods for detecting heap overflow provided in an embodiment of the present application;
[0045] Figure 2 for Figure 1 A method flow chart of step S102;
[0046] Figure 3 For Figure 1 A flow chart of one of the methods after step S105;
[0047] Figure 4 A flow chart of one of the methods for detecting heap overflow provided in an embodiment of the present application;
[0048] Figure 5 A structural block diagram of one of the devices for detecting heap overflow provided in an embodiment of the present application;
[0049] Figure 6 This is a structural block diagram of one of the electronic devices provided in the embodiments of the present application. DETAILED DESCRIPTION
[0050] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.
[0051] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.
[0052] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.
[0053] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.
[0054] Before introducing a method for detecting a heap overflow provided in an embodiment of the present application, for ease of understanding, the technical background of the embodiment of the present application is first introduced in detail.
[0055] In the related art, the existing heap manager mainly uses stack canary technology to place fixed values before and after the stack to detect overflow, which has many shortcomings:
[0056] 1) Position predictability: Placing values at fixed positions on the stack can be easily predicted and bypassed by attackers, reducing security;
[0057] 2) Single detection point: Canary is only set at the beginning or end of the stack, which limits the scope of memory overflow detection and cannot detect attacks that modify the heap structure by data overflow on the heap block;
[0058] 3) Lack of flexibility: The fixed-position stack canary value cannot adapt to heap blocks of different sizes and types, limiting its application in diverse memory management scenarios;
[0059] 4) Low update efficiency: When the heap block data is updated, the stack canary needs to be reset, which increases the maintenance cost, especially in scenarios with frequent allocation and release.
[0060] In view of this, the present application provides a method, device and electronic device for detecting heap overflow, which are used to improve the security of the heap manager.
[0061] The following is a detailed introduction to the relevant technical terms involved in the embodiments of the present application.
[0062] Canary: In the field of computer security, a canary is a mechanism used to detect heap overflow attacks; it is usually a specific value placed at a predetermined location in a heap block to monitor whether the boundary of the heap block is overwritten by the overflowed data;
[0063] Heap Manager: The heap manager is the component of the operating system or runtime environment that is responsible for allocating and managing dynamic memory; it handles program memory requests, allocates and releases memory blocks, and ensures efficient use of memory;
[0064] Cryptographically Secure Pseudo-Random Number Generator (CSPRNG): CSPRNG is an algorithm for generating pseudo-random numbers, whose output is highly unpredictable and sufficient to resist cryptographic attacks; in the embodiment of the present application, CSPRNG is used to randomly generate the Canary value of the heap block and determine its position in the heap block;
[0065] Heap Overflow: Heap overflow is a common buffer overflow attack. The attacker writes data exceeding its allocated size to the heap memory, overwriting the control information of adjacent memory blocks, which may cause the program to crash or execute malicious code.
[0066] Heap Canary Table: In an embodiment of the present application, the heap canary table is a data structure used to track and manage which memory blocks in the heap contain heap canaries, as well as the value and location information of the heap canaries, so as to facilitate effective overflow detection;
[0067] Memory Allocation: Memory allocation refers to the process of a program requesting memory resources to store data. In the embodiment of the present application, when allocating memory, it will decide whether to insert a heap canary as needed, and record relevant information.
[0068] Memory Deallocation: Memory deallocation is the reverse process of memory allocation, which means that the program releases memory resources that are no longer used. In the embodiment of the present application, the heap Canary value is verified when the memory is released to ensure that the memory block has not been changed.
[0069] Unpredictability: Unpredictability refers to the property that the output or behavior of a system or mechanism is difficult to be predicted externally. In the embodiment of the present application, the unpredictability of the heap manager is enhanced and the security is improved by inserting randomized heap canaries.
[0070] like Figure 1 As shown, an embodiment of the present application provides a method for detecting a heap overflow, which is applied to a heap manager and includes:
[0071] S101: receiving a memory allocation request from an application, and determining a heap block of a size currently required by the application;
[0072] In the specific implementation process, when an application requests memory allocation, the heap manager receives the memory allocation request from the application and determines the heap block size currently required by the application; illustratively, application A currently requests to allocate a heap block of n bytes; wherein the value range of n is 0 to 255.
[0073] It should be noted that before the application requests memory from the heap manager, it is necessary to initialize the heap manager and pseudo-random number generator, and set up necessary data structures, such as a heap block pool, a table with a preset data structure (which can be recorded as a heap canary table), etc. For example, an initial seed S can be set to initialize a cryptographically secure pseudo-random number generator.
[0074] S102: randomly deciding whether to insert a canary into the heap block through a pseudo-random generator;
[0075] In a specific implementation process, a pseudo-random generator can be used to decide whether to insert a canary into a heap block based on the probability of inserting the canary.
[0076] S103: If yes, randomly determine the position of the canary in the heap block by using the pseudo-random generator, and randomly generate a first canary value for the heap block;
[0077] In the specific implementation process, for the heap block that needs to insert the canary (which can be recorded as the heap Canary), the pseudo-random generator is used again to randomly determine the position of the canary in the heap block. For example, the position can be an offset relative to the start position of the heap block. In other words, the insertion position and value of the canary of the heap block are determined by the pseudo-random generator, which effectively increases the difficulty for attackers to predict and bypass the heap protection mechanism.
[0078] S104: allocating the heap block to the application, and inserting the first canary value into the position of the heap block;
[0079] S105: recording the identifier of the heap block, the position and the first canary value in a table having a preset data structure;
[0080] In a specific implementation, the identifier, location, and first canary value of the heap block can be recorded in the heap canary table. For example, a Handle can be used to abstract the identifier of the heap block. In this way, the table can be used to track which heap blocks contain heap canaries and the offsets and values of the heap canaries.
[0081] S106: in the process of using the heap block, detecting whether the second canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block;
[0082] In the specific implementation process, in the process of using a heap block, for example, the heap manager allocates the heap block to an application, and the process of the application using the heap block can be when the data stored in the heap block is read next time, or when the data stored in the heap block is modified, the heap manager detects whether the second canary value monitored at the position where the canary value is inserted in the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block. In other words, the heap manager tracks the canary value at the corresponding position of the heap block through the heap canary table.
[0083] S107: If they are inconsistent, it indicates that a heap overflow occurs in the heap block.
[0084] In the specific implementation process, if the second canary value is inconsistent with the first canary value, it indicates that the heap block has a heap overflow; if the second canary value is consistent with the first canary value, it indicates that the heap block has not been attacked by a heap overflow, and the application can use the heap block normally. In this way, effective detection of heap overflow attacks is achieved, and the security of the heap manager is improved.
[0085] In the embodiments of the present application, by introducing the heap canary table data structure and a cryptographically secure pseudo-random number generator, key steps such as dynamic decision-making, random position selection and value generation are integrated, the traditional heap overflow detection algorithm is improved, and optimizations such as security enhancement, detection range expansion and maintenance cost reduction are achieved; not only the protection capability of the heap manager is improved, but also the efficiency and flexibility of the operation are maintained.
[0086] In the embodiments of the present application, Figure 2 As shown, step S102: randomly deciding whether to insert a canary into the heap block by using a pseudo-random generator, including:
[0087] S201: Generate a random number by the pseudo-random generator, where the value range of the random number is within [0,1);
[0088] S202: If the random number is less than a preset threshold, decide to insert a canary into the heap block.
[0089] In the specific implementation process, the specific implementation process of step S201 to step S202 is as follows:
[0090] For memory allocation requests from applications, a CSPRNG can be used to generate a random number (referred to as R), which is usually in the range of [0,1). Then, the random number is compared with a preset threshold, where the preset threshold is used to characterize the probability of inserting a canary into a heap block. Exemplarily, the preset threshold is T=0.1, which indicates that approximately 10% of the heap blocks will be inserted into the heap Canary; if the randomly generated random number R is less than the preset threshold T, it is decided to insert a canary into the current heap block; otherwise, there is no need to insert a canary into the current heap block. In this way, a random decision on whether to insert a canary into a heap block is implemented.
[0091] In the embodiments of the present application, Figure 3 As shown, in step S105: after recording the identifier of the heap block, the position and the first canary value in a table with a preset data structure, the method further includes:
[0092] S301: if a memory release request is received from the application, verify whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block;
[0093] S302: If they are inconsistent, it indicates that the canary value inserted into the heap block is changed, triggering a security warning.
[0094] In the specific implementation process, the specific implementation process of step S301 to step S302 is as follows:
[0095] When the application releases memory, the heap manager receives the memory release request from the application and searches for the corresponding heap canary information in the heap canary table according to the identifier of the heap block. When the heap block is released, it is verified whether the third canary value monitored at the location of the heap block is consistent with the first canary value corresponding to the location found in the heap canary table according to the identifier of the heap block; if the third canary value is inconsistent with the first canary value, it indicates that the canary value currently inserted into the heap block has been changed, triggering a security warning, thereby achieving effective protection against heap overflow attacks. In one exemplary embodiment, if the third canary value is inconsistent with the first canary value, corresponding protection measures can also be triggered, thereby improving the protection performance of the heap manager.
[0096] In the embodiment of the present application, in step S301: if a memory release request is received from the application, then after verifying whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block, the method further includes:
[0097] If they are consistent, the heap block is safely released.
[0098] In the specific implementation process, when the heap block is released, it is verified whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found from the heap Canary table according to the identifier of the heap block; if the third canary value is consistent with the first canary value, the heap block is safely released.
[0099] In an embodiment of the present application, after the heap block is safely released, the state of the heap manager can also be updated, and the data structure of the heap canary table and the heap block pool can be updated accordingly. In addition, the heap manager can also continuously monitor memory usage and perform maintenance according to actual application needs. For example, free heap blocks can be merged and damaged heap blocks can be cleaned up.
[0100] It should be noted that the detection method for heap overflow provided in the embodiment of the present application not only enhances the accuracy of heap overflow detection, but also maintains the efficiency of memory allocation and release, and is suitable for application scenarios of heap memory security, such as operating system kernel, large database management system, cloud computing platform, etc. In these application scenarios, memory security is crucial, and any overflow attack may lead to serious consequences.
[0101] Combine the following Figure 4 The method flow chart and related codes shown provide a detailed description of the complete process of the heap overflow detection method provided in the embodiment of the present application.
[0102] S1: Initialize the heap manager;
[0103] When the system starts or the heap manager is initialized, the necessary data structures are set up, such as the heap block pool, heap canary table, etc., and the pseudo-random number generator is initialized.
[0104] Handle structure: used to identify abstract heap blocks.
[0105] typedef struct{
[0106] uint64_t id; / / unique identifier
[0107] }Handle;
[0108] Heap block structure: contains the actual memory block and heap Canary value.
[0109] typedef struct HeapBlock{
[0110] uint64_t canary; / / Heap Canary value
[0111] size_t size; / / allocated memory size
[0112] char data[]; / / The place where the data is actually stored
[0113] }HeapBlock;
[0114] Heap manager structure: Contains a map of all heap blocks and a heap canary table.
[0115] typedef struct HeapManager{
[0116] Handle*handles; / / Handle array
[0117] HeapBlock**blocks; / / heap block array
[0118] size_t capacity; / / capacity
[0119] size_t size; / / The number currently used
[0120] uint64_t next_id; / / The ID of the next Handle
[0121] }HeapManager;
[0122] Initialize the heap manager
[0123] HeapManager init_heap_manager(size_t initial_capacity){
[0124] HeapManager manager = {0};
[0125] manager.handles=malloc(initial_capacity*sizeof(Handle));
[0126] manager.blocks=malloc(initial_capacity*sizeof(HeapBlock*));
[0127] manager.capacity=initial_capacity;
[0128] manager.size = 0;
[0129] manager.next_id = 1; / / used to generate a unique ID
[0130] init_prng(); / / Initialize the pseudo-random number generator
[0131] return manager;
[0132] }
[0133] Heap Canary Table: The heap canary table is used to store heap canary values and corresponding handles.
[0134] typedef struct CanaryTable{
[0135] uint64_t* canary_values; / / Heap Canary value array
[0136] Handle*handles; / / Corresponding Handle array
[0137] size_t*canary_bitmap; / / Bitmap used to mark which heap blocks contain heap Canary
[0138] size_t size; / / Number of heap canaries currently stored
[0139] size_t capacity; / / Capacity of the heap Canary table
[0140] }CanaryTable;
[0141] Allocate bitmap when initializing CanaryTable
[0142] CanaryTable init_canary_table(size_t initial_capacity){
[0143] CanaryTable table;
[0144] table.canary_values=calloc(initial_capacity,sizeof(uint64_t));
[0145] table.handles=calloc(initial_capacity,sizeof(Handle));
[0146] table.canary_bitmap=calloc((initial_capacity+63) / 64,sizeof(size_t));
[0147] / / Allocate bitmap
[0148] table.size = 0;
[0149] table.capacity=initial_capacity;
[0150] return table;
[0151] }
[0152] S2: memory allocation request;
[0153] When an application requests memory allocation, the heap manager receives the request and determines a memory block (i.e., a heap block) of the required size.
[0154] S3: random decision heap canary insertion;
[0155] Set an initial seed S to initialize a cryptographically secure pseudo-random number generator. The application requests to allocate a memory block of size n bytes. For each memory allocation request, a random number R is generated using CSPRNG, which is usually in the range of [0,1). Set a threshold T, which determines the probability of inserting a heap canary. For example, if T = 0.1, approximately 10% of the heap blocks will have a heap canary inserted. If the randomly generated number R is less than the threshold T, it is decided to insert a heap canary into the current heap block.
[0156] S4: Randomly select the heap canary location and value;
[0157] For the heap block where the heap canary is inserted, CSPRNG is used again to generate a random number to determine the position P of the heap canary, which is the offset relative to the start position of the heap block.
[0158] Generate a random heap canary value C for each selected heap block.
[0159] S5: Allocate memory and insert heap Canary;
[0160] Create a heap canary table to track which heap blocks contain heap canaries, as well as the offset and value of the heap canary. Record the identifier of the heap block, the position P of the heap canary, and the value C of the heap canary in the heap canary table. Insert the heap canary value C at the determined position P, and then allocate the memory block to the user. Exemplarily, a bitmap can be used to track which heap blocks in the heap canary table contain heap canaries.
[0161] Use Handle to abstract the identification of heap blocks, and use HeapManager to manage all heap blocks and Handles. The heap canary table is used to store heap canary values and corresponding handles for verification during allocation and release. In this way, users cannot perceive the existence of heap canary when calling alloc and free functions. Even if the handle id is obtained, it is not the real address. In this way, the heap manager can protect the memory from unauthorized access.
[0162] S6: Record heap canary information;
[0163] The identifier of the heap block, the location and value of the heap canary are recorded in the heap canary table for subsequent verification.
[0164] S7: User data usage;
[0165] The user starts to use the allocated memory area to store data. It should be noted that based on the heap blocks other than the heap canary, the memory area required to store data is allocated to the user, that is, the place where the data is actually stored.
[0166] Allocate memory:
[0167]
[0168]
[0169] S8: memory release request;
[0170] When the application releases memory, the heap manager receives the release request and searches the heap canary table for the corresponding heap canary information based on the heap block identifier. When the memory block is released, the heap canary value C and position P recorded in the heap canary table are retrieved to verify the integrity of the memory block.
[0171] Heap Canary Table Operation
[0172]
[0173] }
[0174] return false;
[0175] }
[0176] void canary_table_remove(CanaryTable*table,Handle handle){
[0177] for(size_t i=0;i <table->size;++i){
[0178] if(table->handles[i].id==handle.id){
[0179] clear_bit(table->canary_bitmap,i); / / clear the mark in the bitmap
[0180] / / You can add code here to move the last element to cover the current element, and then reduce the size
[0181] break;
[0182] }
[0183] }
[0184] }
[0185] S9: Heap Canary verification;
[0186] Before releasing a heap block, the heap manager verifies that the heap canary value has not been changed. If the heap canary value is consistent with the recorded value, the heap block is safely released; if it is inconsistent, a security warning or protection measure is triggered.
[0187] Freeing up memory
[0188] void free_heap(HeapManager*manager,void*ptr){
[0189] / / Return from ptr to HeapBlock
[0190] HeapBlock*block=(HeapBlock*)((char*)ptr-sizeof(HeapBlock));
[0191] / / S8: Memory release request
[0192] / / Find Handle
[0193] Handle handle;
[0194] for(size_t i=0;i <manager->size;++i){
[0195] if(manager->blocks[i]==block){
[0196] handle=manager->handles[i];
[0197] break;
[0198]
[0199] S10: Update the heap manager status;
[0200] According to the result of memory release, the status of the heap manager is updated, including the heap canary table and heap block pool.
[0201] S11: Maintenance and monitoring;
[0202] The heap manager continuously monitors memory usage and performs maintenance as needed, such as merging free heap blocks and cleaning up damaged heap blocks.
[0203] / / Set the bits in the bitmap
[0204] void set_bit(size_t*bitmap,size_t position){
[0205] size_t word_num=position / (sizeof(size_t)*8);
[0206] size_t bit_num=position%(sizeof(size_t)*8);
[0207] bitmap[word_num]|=(1UL< <bit_num);
[0208] }
[0209] / / Clear the bits in the bitmap
[0210] void clear_bit(size_t*bitmap,size_t position){
[0211] size_t word_num=position / (sizeof(size_t)*8);
[0212] size_t bit_num=position%(sizeof(size_t)*8);
[0213] bitmap[word_num]&=~(1UL< <bit_num);
[0214] }
[0215] / / Check if the bit in the bitmap is set
[0216] bool is_bit_set(size_t*bitmap,size_t position){
[0217] size_t word_num=position / (sizeof(size_t)*8);
[0218] size_t bit_num=position%(sizeof(size_t)*8);
[0219] return(bitmap[word_num]&(1UL< <bit_num))!=0;
[0220] }
[0221] Of course, in addition to using the above-mentioned codes to implement the detection method for heap overflow provided in the embodiment of the present application, other code forms can also be used to implement it according to actual application needs, which is not limited here.
[0222] Based on the same inventive concept, Figure 5 As shown, the embodiment of the present application also provides a detection device for heap overflow, which is applied to a heap manager, including:
[0223] The first determining unit 10 is used to receive a memory allocation request from an application and determine a heap block of a size currently required by the application;
[0224] A decision unit 20, configured to randomly decide whether to insert a canary into the heap block by using a pseudo-random generator;
[0225] The second determining unit 30, if yes, randomly determines the position of the canary in the heap block by using the pseudo-random generator, and randomly generates a first canary value for the heap block;
[0226] an allocating unit 40, configured to allocate the heap block to the application and insert the first canary value into the position of the heap block;
[0227] A recording unit 50, configured to record the identifier of the heap block, the position and the first canary value in a table having a preset data structure;
[0228] The detection unit 60 is used to detect whether the second canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block during the use of the heap block; if they are inconsistent, it indicates that a heap overflow has occurred in the heap block.
[0229] In the embodiment of the present application, the decision unit 20 is specifically used for:
[0230] Generate a random number through the pseudo-random generator, the value range of the random number is within [0,1);
[0231] If the random number is less than a preset threshold, it is decided to insert a canary into the heap block.
[0232] In the embodiment of the present application, after the recording unit 50 records the identifier of the heap block, the position and the canary value in a table having a preset data structure, the apparatus further includes a verification unit 70, and the verification unit 70 is specifically used to:
[0233] If a memory release request is received from the application, verify whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block;
[0234] If they are inconsistent, it indicates that the canary value inserted into the heap block is changed, triggering a security warning.
[0235] In the embodiment of the present application, the verification unit 70 is also used for:
[0236] If they are consistent, the heap block is safely released.
[0237] Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the above Figure 5 Function, reference Figure 6 , the electronic device comprises:
[0238] Memory 100, used for storing computer programs;
[0239] The processor 200 is used to implement the steps of the method for detecting heap overflow as described in any of the above items when executing the computer program stored in the memory.
[0240] The specific connection medium between the processor 200 and the memory 100 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 200 and the memory 100 are connected via the bus 300. The bus 300 is connected to the memory 100 via the bus 300. Figure 6 The bus 300 is represented by a bold line, and the connection between other components is only for schematic illustration and is not intended to be limiting. The bus 300 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus 300 or one type of bus 300. Alternatively, the processor 200 may also be called a controller, and there is no limitation on the name.
[0241] In the embodiment of the present application, the memory 100 stores instructions that can be executed by the processor 200. When the processor 200 executes the computer program stored in the memory 100, the detection method for heap overflow discussed above can be executed. The processor 200 can implement Figure 5 The functions of each module are shown in the figure.
[0242] Among them, the processor 200 is the control center of the device, and can use various interfaces and lines to connect various parts of the entire control device, and through running or executing computer programs stored in the memory 100 and calling data stored in the memory 100, the various functions of the device and process data, thereby monitoring the device as a whole.
[0243] In one possible design, the processor 200 may include one or more processing units, and the processor 200 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. In some embodiments, the processor 200 and the memory 100 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.
[0244] The memory 100, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 100 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Alternatively, the memory 100 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 100 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.
[0245] By designing and programming the processor, the code corresponding to the detection method for heap overflow introduced in the above embodiment can be fixed into the chip, so that the chip can execute the steps of the detection method for heap overflow discussed above when running. How to design and program the processor is a technology well known to those skilled in the art and will not be described here.
[0246] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, and the computer program is used to enable a computer to execute the steps of the detection method for heap overflow discussed above.
[0247] In some possible implementations, various aspects of the detection method for heap overflow provided in the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the detection method for heap overflow according to various exemplary embodiments of the present application described above in this specification.
[0248] The embodiment of the present application provides a method, device and electronic device for detecting heap overflow. First, an application requests memory allocation, and a heap manager receives the memory allocation request from the application and determines a heap block of the size required by the application. Exemplarily, the application requests the allocation of a heap block of 10 bytes. Then, a pseudo-random generator is used to randomly decide whether to insert a canary in the heap block. If yes, the position of the canary in the heap block and the corresponding first canary value are randomly determined by the pseudo-random generator. Then, the heap block is allocated to the application, and the first canary value is inserted at the randomly determined position of the heap block. Then, the identifier, position and first canary value of the heap block are recorded in a table with a preset data structure. Then, in the process of using the heap block, it is detected whether the second canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block. If they are inconsistent, it indicates that a heap overflow has occurred in the heap block.
[0249] That is to say, in the process of using heap blocks, the heap manager can monitor the canary value at the corresponding position by randomly selecting a position in the heap block and randomly inserting the canary value, thereby detecting potential heap overflow attacks; due to the randomness and dynamics of the entire method, it is difficult for attackers to predict the specific position of the canary, thereby improving the security of the heap manager.
[0250] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0251] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0252] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0253] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0254] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A method for detecting heap overflow, applied to a heap manager, characterized in that: include: Receiving a memory allocation request from an application and determining a heap block of a size currently required by the application; Randomly decide whether to insert a canary into the heap block by using a pseudo-random generator; If yes, randomly determine the position of the canary in the heap block by using the pseudo-random generator, and randomly generate a first canary value for the heap block; Allocating the heap block to the application, and inserting the first canary value at the position of the heap block; Recording the identifier of the heap block, the position and the first canary value in a table having a preset data structure; In the process of using the heap block, detecting whether a second canary value monitored at the position of the heap block is consistent with a first canary value corresponding to the position found in the table according to an identifier of the heap block; If they are inconsistent, it indicates that a heap overflow occurs in the heap block.
2. The method according to claim 1, characterized in that The randomly deciding whether to insert a canary into the heap block by using a pseudo-random generator includes: Generate a random number through the pseudo-random generator, the value range of the random number is within [0,1); If the random number is less than a preset threshold, it is decided to insert a canary into the heap block.
3. The method according to claim 1 or 2, characterized in that After recording the identifier of the heap block, the position and the first canary value in a table having a preset data structure, the method further includes: If a memory release request is received from the application, verify whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block; If they are inconsistent, it indicates that the canary value inserted into the heap block is changed, triggering a security warning.
4. The method according to claim 3, characterized in that After verifying whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block, the method further includes: If they are consistent, the heap block is safely released.
5. A detection device for heap overflow, applied to a heap manager, characterized in that: include: A first determining unit, configured to receive a memory allocation request from an application program and determine a heap block of a size currently required by the application program; A decision unit, configured to randomly decide whether to insert a canary into the heap block by using a pseudo-random generator; The second determining unit, if yes, randomly determines the position of the canary in the heap block by using the pseudo-random generator, and randomly generates a first canary value for the heap block; an allocating unit, configured to allocate the heap block to the application and insert the first canary value into the position of the heap block; a recording unit, configured to record the identifier of the heap block, the position and the first canary value in a table having a preset data structure; a detection unit, configured to detect, during use of the block, whether a second canary value monitored at the position of the block is consistent with a first canary value corresponding to the position found in the table according to an identifier of the block; If they are inconsistent, it indicates that a heap overflow occurs in the heap block.
6. The device according to claim 5, characterized in that The decision-making unit is specifically used for: Generate a random number through the pseudo-random generator, the value range of the random number is within [0,1); If the random number is less than a preset threshold, it is decided to insert a canary into the heap block.
7. The device according to claim 5 or 6, characterized in that After the recording unit records the identifier of the heap block, the position and the canary value in a table having a preset data structure, the device further includes a verification unit, which is specifically used to: If a memory release request is received from the application, verify whether the third canary value monitored at the position of the heap block is consistent with the first canary value corresponding to the position found in the table according to the identifier of the heap block; If they are inconsistent, it indicates that the canary value inserted into the heap block is changed, triggering a security warning.
8. An electronic device, characterized in that: include: Memory, used to store computer programs; The processor is used to implement the method steps as described in any one of claims 1 to 4 when executing the computer program stored in the memory.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to enable a computer to execute the method steps as described in any one of claims 1 to 4.
10. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 4.