Memory security violation detection method and device, computer equipment and storage medium
By inserting magic numbers into the memory of the application to judge the accessibility of memory objects, the problem of low resource utilization efficiency in the existing technology is solved, and more efficient memory security violation detection is achieved.
Patent Information
- Application Number
- CN202510591452.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-08
- Publication Date
- 2025-08-26
AI Technical Summary
The memory security violation detection method in the prior art leads to low resource utilization efficiency, mainly because the shadow memory needs to be checked before accessing memory objects, which introduces additional runtime overhead.
Insert magic numbers into the application's memory in advance, and judge its accessibility by determining whether there are magic numbers stored in the target memory object, thereby determining whether there are memory security violations and avoiding direct query of shadow memory.
Reduces additional runtime overhead when the application runs and improves resource utilization efficiency.
Smart Images
Figure CN120540975A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a memory security violation detection method, apparatus, computer equipment, and storage medium. Background Art
[0002] During the operation of an application, memory safety violations often lead to serious consequences such as system crashes, data leaks, or execution flow hijacking. Among them, using memory-unsafe languages such as C and C++ to write applications is a major cause of memory safety violations during their operation.
[0003] Currently, memory error detection tools such as ASan are commonly used to detect memory safety violations. Specifically, ASan detects memory safety violations in the following way: first, corresponding shadow memory is allocated to each memory object called by the application. In this way, before accessing the memory object, the corresponding shadow memory can be checked to check whether there is a memory safety violation.
[0004] However, this approach requires checking the corresponding shadow memory to check for memory safety violations before accessing each memory object. Therefore, it introduces an additional runtime overhead of approximately 1 times, resulting in a significant reduction in resource utilization efficiency. Summary of the Invention
[0005] The purpose of the embodiments of the present application is to propose a memory security violation detection method, apparatus, computer equipment and storage medium to solve the problem of low resource utilization efficiency in the prior art.
[0006] In order to solve the above technical problems, the present invention provides a memory security violation detection method, which adopts the following technical solutions:
[0007] Inserting magic numbers in advance into the red zone and released memory area in the memory allocated by each application, the method comprising:
[0008] Determine whether a magic number is stored in a target memory object of a specified application; the target memory object is a continuous memory segment in a heap area, a stack area, or a global area where a memory safety violation may occur;
[0009] In a case where a magic number is stored in the target memory object, determining whether the target memory object is accessible;
[0010] In a case where the target memory object is inaccessible, it is determined that a memory safety violation exists.
[0011] Preferably, determining whether the target memory object is accessible specifically includes:
[0012] Obtain metadata of the shadow memory corresponding to the target memory object;
[0013] Determine whether the target memory object is accessible according to the metadata.
[0014] Preferably, the magic number is a magic number constant of N bytes, where N is 1, 2, 4, or 8; and determining whether the magic number is stored in the target memory object of the specified application program specifically includes:
[0015] Get the memory value of the target memory object;
[0016] Determine whether the memory value is equal to the magic constant of N bytes;
[0017] If not, determining that the magic number is not stored in the target memory object;
[0018] If so, it is determined that the magic number is stored in the target memory object.
[0019] Preferably, before determining whether the target memory object of the specified application stores a magic number, the method further includes:
[0020] Code stubbing is performed in advance on instructions and functions related to memory allocation, memory release, and memory access in the specified application, so as to obtain, through the inserted code, the memory objects allocated, released, and accessed during the running of the specified application as the target memory objects.
[0021] Preferably, code stubs are pre-inserted on instructions and functions related to memory allocation, memory release, and memory access in the specified application, specifically including:
[0022] Obtaining the source code of the specified application;
[0023] Compiling the source code into an intermediate representation code;
[0024] Performing static analysis on the intermediate representation code to determine instructions and functions related to memory allocation, memory release, and memory access in the source code;
[0025] Code stubbing is performed on instructions and functions related to memory allocation, memory release, and memory access in the source code.
[0026] Preferably, static analysis is performed on the intermediate representation code to determine instructions and functions in the source code related to memory allocation, memory release, and memory access, specifically including:
[0027] By statically analyzing the intermediate representation code and querying the function library, instructions and functions related to memory allocation, memory release and memory access in the source code are determined and code instrumentation is performed.
[0028] Preferably, before determining whether the target memory object of the specified application stores a magic number, the method further includes:
[0029] Redundant detection elimination algorithm is used to eliminate redundant detection and merge multiple adjacent memory detections.
[0030] To solve the above technical problems, an embodiment of the present application further provides a memory security violation detection device, characterized in that a magic number is pre-inserted into the red zone and released memory area in the memory allocated by each application. The device includes:
[0031] a magic number determination unit, configured to determine whether a magic number is stored in a target memory object of a specified application; the target memory object being a continuous memory segment in a heap area, a stack area, or a global area where a memory safety violation may occur;
[0032] a second determining unit, configured to determine whether the target memory object is accessible if a magic number is stored in the target memory object;
[0033] The security violation determining unit is configured to determine the presence of a memory security violation when the target memory object is inaccessible.
[0034] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:
[0035] The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the above method when executing the computer-readable instructions.
[0036] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:
[0037] The computer-readable storage medium stores computer-readable instructions, which implement the steps of the above method when executed by a processor.
[0038] The present application provides a memory safety violation detection method that pre-inserts magic numbers into the red zone and freed memory areas of memory allocated to each application. It then determines whether the target memory object of the specified application stores the magic number. If the target memory object stores the magic number, it further determines whether the target memory object is accessible. If the target memory object is inaccessible, it determines that a memory safety violation has occurred. In this way, for the target memory object of the specified application, rather than directly querying its shadow memory class to determine whether a memory safety violation has occurred, it first determines whether the target memory object stores the magic number. Only if the magic number exists is it further determined whether the target memory object is accessible. This reduces the additional runtime overhead of the specified application and improves resource utilization efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.
[0040] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;
[0041] Figure 2 This is a flowchart of a memory security violation detection method according to an embodiment of the present application;
[0042] Figure 3 This is a structural diagram of a memory security violation detection device provided by an embodiment of the present application;
[0043] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION
[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.
[0045] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.
[0046] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.
[0047] like Figure 1 As shown, system architecture 100 may include a terminal device 101, a network 102, and a server 103. Terminal device 101 may be a laptop computer 1011, a tablet computer 1012, or a mobile phone 1013. Network 102 is a medium for providing a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired or wireless communication links or fiber optic cables.
[0048] The user can use the terminal device 101 to interact with the server 103 via the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.
[0049] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, tablet computer 1012 or mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III, Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV, Moving Picture Experts Group Audio Layer IV) player, a laptop computer and a desktop computer, etc.
[0050] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .
[0051] It should be noted that the method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the apparatus is generally set in the server / terminal device.
[0052] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.
[0053] Continue to refer Figure 2 , shows a flowchart of an embodiment of the memory security violation detection method provided in an embodiment of the present application. For ease of understanding, the basic principles of the method can be briefly explained here.
[0054] In the method provided in the embodiment of the present application, magic numbers are pre-inserted into the red zone and the released memory area in the memory allocated by the application. For example, magic numbers can be inserted into the red zone and the released memory area in the memory allocated by each application running in the electronic device. The application can be each application running in the electronic device, and memory needs to be allocated to it during the operation of the application. In AddressSanitizer (ASan), the red zone refers to the area before and after the memory allocated by malloc. In the present application, magic numbers are pre-inserted into the red zone and the released memory area in the memory allocated by the application, so that the red zone and the released memory area in the memory allocated by the application are marked by the magic number.
[0055] exist Figure 2 In the method shown, some or all of the steps of the method can be performed by Figure 1 The method is executed by the server 103 or the terminal device 101 shown. For example, the method is described here using the server 103 as an example. The method includes the following steps:
[0056] Step S21: Determine whether a magic number is stored in the target memory object of the specified application.
[0057] The memory object is a contiguous segment of memory in the heap, stack, or global memory area where a memory safety violation may occur. The target memory object is specifically a memory object called by a specified application during execution. For example, each memory object required to be called by the specified application during execution can be used as the target memory object. The specified application can be an application written in a memory-unsafe language such as C or C++ in an electronic device.
[0058] Specifically, during the execution of the designated application, the target memory object needs to be called. In step S21, it is necessary to determine whether the target memory object stores a magic number. For example, the magic number may be an N-byte magic constant MAGIC_VALUE_N (where N can be 1, 2, 4, or 8). In this case, the memory value of the target memory object is first obtained, and then a determination is made whether the memory value is equal to the N-byte magic constant MAGIC_VALUE_N. If not, it is determined that the target memory object does not store a magic number and is legal, so the target memory object can be called. If so, it is determined that the target memory object stores a magic number. At this point, since magic numbers are pre-inserted into the red zone and released memory areas of memory allocated by each application, it can be determined that the target memory object may be the red zone or released memory area of another application (in which case, a memory safety violation has occurred), or the red zone or released memory area of the designated application itself (in which case, no memory safety violation has occurred), thus requiring further, more accurate detection.
[0059] Step S22: If a magic number is stored in the target memory object, determine whether the target memory object is accessible.
[0060] As mentioned above, if a magic number is stored in the target memory object, it indicates that the target memory object may be a red zone or released memory area of another application, or it may be a red zone or released memory area of the designated application itself, so further and more accurate detection is required. Thus, in step S22, whether the target memory object is accessible is further determined. For example, according to the relevant rules of ASan, metadata of the shadow memory of the target memory object can be obtained at this time, and whether the target memory object is accessible can be determined based on this metadata.
[0061] For example, according to ASan rules, shadow memory is typically used to record whether a corresponding memory object is safe to access. Specifically, 1 / 8 of the memory is used as shadow memory, using an 8:1 mapping ratio, meaning that every 8 bytes of memory object is mapped to 1 byte of shadow memory. Using a specific mapping algorithm, such as ShadowAddr = (Addr>>3) + Offset, the address of a memory object can be converted to the address of the corresponding shadow memory.
[0062] In this way, the value of the byte in the shadow memory (i.e., metadata) is used to indicate the accessibility status of the corresponding 8 bytes of main memory. Specifically, a value of 0 indicates that all 8 bytes of the memory object are accessible; a value of k (1 <= k <= 7) indicates that the first k bytes are accessible, and the last (8-k) bytes are inaccessible; a negative value indicates that the entire 8 bytes are inaccessible. Different negative values can also indicate different types of inaccessibility, such as freed memory and local variable memory that has been popped off the stack.
[0063] Therefore, in step S22 of the present application, metadata of the shadow memory of the target memory object can be obtained, and then whether the target memory object is accessible can be determined based on the metadata. For example, if the metadata is 0, it means that all 8 bytes of the target memory object are accessible. If the metadata is a negative number or a value between 1 and 7, it means that some or all of the 8 bytes of the target memory object are inaccessible, that is, inaccessible.
[0064] Step S23: If the target memory object is inaccessible, determine that a memory safety violation exists.
[0065] Through the above-mentioned step S22, it is possible to determine whether the target memory object is accessible. If the target memory object is accessible, then according to the relevant rules of ASan, it means that the target memory object is the red zone or released memory area of the specified application itself, and therefore the access of the specified application to the target memory object is legal, so that the specified application can call the target memory object normally; on the contrary, if the target memory object is inaccessible, then it means that the target memory object is the red zone or released memory area of other applications, and therefore it can be determined that the access of the specified application to the target memory object is illegal, and then it can be determined that there is a memory security violation.
[0066] In addition, when it is determined that a memory safety violation exists, the operation of the designated application program may be terminated, and an error message may be output to prompt that the designated application program has a memory safety violation.
[0067] The memory safety violation detection method provided in the embodiments of the present application pre-inserts a magic number into the red zone and freed memory area of memory allocated to each application. It then determines whether the target memory object of the specified application stores the magic number. If the magic number is stored in the target memory object, it further determines whether the target memory object is accessible. If the target memory object is inaccessible, it determines that a memory safety violation has occurred. In this way, for the target memory object of the specified application, rather than directly querying its shadow memory class to determine whether a memory safety violation has occurred, it first determines whether the target memory object stores the magic number. Only if the magic number is present is it further determined whether the target memory object is accessible. This reduces the additional runtime overhead of the specified application and improves resource utilization efficiency.
[0068] As mentioned above, the designated application in this application can be an application written in a memory-unsafe language such as C language, C++ language, etc. in an electronic device, and then the memory safety violation detection is performed on it through the above-mentioned steps S21 to S23. In actual applications, before the memory safety violation detection is performed on the designated application, the code of the designated application can also be inserted first, that is, before the above-mentioned step S21, the method can also include: pre-inserting the code of the instructions and functions related to memory allocation, memory release and memory access in the designated application, so that the memory objects allocated, released and accessed during the operation of the designated application can be obtained through the inserted code as the target memory object.
[0069] For example, the inserted code can be used to obtain the various memory objects allocated, released, and accessed during the operation of the specified application, and then these memory objects are used as the target memory objects respectively, and memory safety violation detection is performed through the above steps S21 to S23.
[0070] It should be further noted that in practical applications, through the above method, that is, obtaining the memory objects allocated, released, and accessed during the operation of the specified application as the target memory objects respectively, and then performing memory safety violation detection through steps S21 to S23. However, in the case of a large number of memory objects, it is still likely to affect the efficiency. In the embodiments of this application, through the redundancy detection elimination algorithm, redundant detections are eliminated and multiple adjacent memory detections are merged. Specifically, for the memory objects in the global area and stack area where memory safety violations are impossible to occur, the corresponding detections are eliminated. For multiple adjacent memory accesses, when two of the memory accesses fall within the same 8-byte area, the detections of these two memory accesses are merged into one detection. Or for the detections of three memory accesses (with their respective addresses being addr1, addr2, and addr3, and addr1 < addr2 < addr3), if the three accesses (addr1, size1), (addr2, size2), (addr3, size3) satisfy: addr3 - addr1 < MinRdSz ∧ addr2 + size2 ≤ addr3 + size3, then the detection of the memory access (addr2, size2) is removed. Here, MinRdSz represents the minimum size of the red zone.
[0071] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, read-only memory (ROM), or a random access memory (RAM), etc.
[0072] It should be understood that although the steps in the flowchart of the accompanying drawings are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit and can be executed in other orders. Moreover, at least some of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time but can be executed at different times. Their execution order is not necessarily sequential but can be executed alternately or in turn with at least a part of other steps or sub-steps or stages of other steps.
[0073] Based on the same inventive concept as the memory security violation detection method provided in the embodiment of the present application, if there is any unclear point in the content of the device embodiment, please refer to the corresponding content in the method embodiment. Among them, magic numbers are pre-inserted into the red zone and released memory area in the memory allocated by each application, such as Figure 3 FIG. 3 is a schematic diagram of a specific structure of the apparatus 30 , which includes a magic number determination unit 301 , a second determination unit 302 , and a security violation determination unit 303 , wherein:
[0074] The magic number determination unit 301 is configured to determine whether a magic number is stored in a target memory object of a specified application; the target memory object is a continuous memory segment in a heap area, a stack area, or a global area where a memory safety violation may occur;
[0075] A second determining unit 302 is configured to determine whether the target memory object is accessible if a magic number is stored in the target memory object;
[0076] The security violation determining unit 303 is configured to determine if a memory security violation exists when the target memory object is inaccessible.
[0077] Since the device 30 adopts the same inventive concept as the memory security violation detection method provided in the embodiment of the present application, it can also solve the problems in the prior art, which will not be described in detail here.
[0078] Determining whether the target memory object is accessible may specifically include:
[0079] Obtain metadata of the shadow memory corresponding to the target memory object;
[0080] Determine whether the target memory object is accessible according to the metadata.
[0081] The magic number is specifically a magic number constant of N bytes, where N is 1, 2, 4, or 8; and determining whether the magic number is stored in the target memory object of the specified application may specifically include:
[0082] Get the memory value of the target memory object;
[0083] Determine whether the memory value is equal to the magic constant of N bytes;
[0084] If not, determining that the magic number is not stored in the target memory object;
[0085] If so, it is determined that the magic number is stored in the target memory object.
[0086] Before determining whether a magic number is stored in the target memory object of the specified application, the apparatus 30 may further include:
[0087] A code stubbing unit is used to pre-insert code on instructions and functions related to memory allocation, memory release and memory access in the specified application, so as to obtain the memory objects allocated, released and accessed during the running of the specified application through the inserted code as the target memory objects.
[0088] The step of pre-instrumenting the instructions and functions related to memory allocation, memory release, and memory access in the specified application program may specifically include:
[0089] Obtaining the source code of the specified application;
[0090] Compiling the source code into an intermediate representation code;
[0091] Performing static analysis on the intermediate representation code to determine instructions and functions related to memory allocation, memory release, and memory access in the source code;
[0092] Code stubbing is performed on instructions and functions related to memory allocation, memory release, and memory access in the source code.
[0093] The static analysis of the intermediate representation code to determine the instructions and functions related to memory allocation, memory release, and memory access in the source code may specifically include:
[0094] By statically analyzing the intermediate representation code and querying the function library, instructions and functions related to memory allocation, memory release and memory access in the source code are determined and code instrumentation is performed.
[0095] Before determining whether a magic number is stored in the target memory object of the specified application, the device 30 may further include: a redundancy detection unit configured to eliminate redundant detections and merge multiple adjacent memory detections using a redundant detection elimination algorithm.
[0096] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device according to an embodiment of the present application.
[0097] The computer device 400 includes a memory 410, a processor 420, and a network interface 430 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 400 having components 410-430, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.
[0098] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.
[0099] The memory 410 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 410 may be an internal storage unit of the computer device 400, such as a hard disk or memory of the computer device 400. In other embodiments, the memory 410 may also be an external storage device of the computer device 400, such as a plug-in hard disk equipped on the computer device 400, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Of course, the memory 410 may also include both the internal storage unit of the computer device 400 and its external storage device. In the embodiment of the present application, the memory 410 is generally used to store the operating system and various application software installed on the computer device 400, such as computer-readable instructions of the method. In addition, the memory 410 can also be used to temporarily store various data that has been output or is to be output.
[0100] In some embodiments, the processor 420 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 420 is generally used to control the overall operation of the computer device 400. In the embodiment of the present application, the processor 420 is used to execute computer-readable instructions or process data stored in the memory 410, such as computer-readable instructions for executing the method provided in the embodiment of the present application.
[0101] The network interface 430 may include a wireless network interface or a wired network interface. The network interface 430 is generally used to establish a communication connection between the computer device 400 and other electronic devices.
[0102] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the above method.
[0103] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.
[0104] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.
Claims
1. A memory safety violation detection method, characterized in that: Inserting magic numbers in advance into the red zone and released memory area in the memory allocated by each application, the method comprising: Determine whether a magic number is stored in a target memory object of a specified application; the target memory object is a continuous memory segment in a heap area, a stack area, or a global area where a memory safety violation may occur; In a case where a magic number is stored in the target memory object, determining whether the target memory object is accessible; In a case where the target memory object is inaccessible, it is determined that a memory safety violation exists.
2. The method according to claim 1, characterized in that Determining whether the target memory object is accessible includes: Obtain metadata of the shadow memory corresponding to the target memory object; Determine whether the target memory object is accessible according to the metadata.
3. The method according to claim 1, characterized in that The magic number is specifically a magic number constant of N bytes, where N is 1, 2, 4, or 8; and determining whether the magic number is stored in the target memory object of the specified application program specifically includes: Get the memory value of the target memory object; Determine whether the memory value is equal to the magic constant of N bytes; If not, determining that the magic number is not stored in the target memory object; If so, it is determined that the magic number is stored in the target memory object.
4. The method according to claim 1, wherein Before determining whether a magic number is stored in the target memory object of the specified application, the method further includes: Code stubbing is performed in advance on instructions and functions related to memory allocation, memory release, and memory access in the specified application, so as to obtain, through the inserted code, the memory objects allocated, released, and accessed during the running of the specified application as the target memory objects.
5. The method according to claim 4, characterized in that Pre-instrument the instructions and functions related to memory allocation, memory release, and memory access in the specified application, specifically including: Obtaining the source code of the specified application; Compiling the source code into an intermediate representation code; Performing static analysis on the intermediate representation code to determine instructions and functions related to memory allocation, memory release, and memory access in the source code; Code stubbing is performed on instructions and functions related to memory allocation, memory release, and memory access in the source code.
6. The method according to claim 5, characterized in that The intermediate representation code is statically analyzed to determine instructions and functions in the source code related to memory allocation, memory release, and memory access, specifically including: By statically analyzing the intermediate representation code and querying the function library, instructions and functions related to memory allocation, memory release and memory access in the source code are determined and code instrumentation is performed.
7. The method according to claim 1, characterized in that Before determining whether a magic number is stored in the target memory object of the specified application, the method further includes: Redundant detection elimination algorithm is used to eliminate redundant detection and merge multiple adjacent memory detections.
8. A memory security violation detection device, characterized in that: Inserting magic numbers in advance into the red zone and released memory area in the memory allocated by each application, the apparatus comprises: a magic number determination unit, configured to determine whether a magic number is stored in a target memory object of a specified application; the target memory object being a continuous memory segment in a heap area, a stack area, or a global area where a memory safety violation may occur; a second determining unit, configured to determine whether the target memory object is accessible if a magic number is stored in the target memory object; The security violation determining unit is configured to determine the presence of a memory security violation when the target memory object is inaccessible.
9. A computer device comprising a memory and a processor, characterized in that: The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the method according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 7.