Pointer Arithmetic Bounds Checking for Non-Adjacent Overflow Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory bounds checking mechanisms introduce substantial overhead during pointer dereferencing and fail to effectively prevent non-adjacent overflows by performing checks only at dereference time, missing vulnerabilities that skip far past buffer ends.
Innovation Solution
A three-pronged approach to memory bounds checking during pointer arithmetic, including generating faults for pointers straying beyond allocation bounds, poisoning pointers near bounds, and faulting on dereferencing poisoned pointers, to enhance efficiency and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bounds checks are performed at pointer dereference time, then memory safety is maintained, but substantial overhead is introduced
Solution Approach 1:
The patent performs bounds checking during pointer arithmetic operations (addition, subtraction, comparison) before the actual pointer dereference occurs. This preliminary action identifies and prevents out-of-bounds pointers early in the execution flow, avoiding the need for repeated checks at each dereference point and reducing overall overhead while maintaining memory safety
2Device complexity
If bounds checks are performed only at dereference time, then implementation simplicity is maintained, but non-adjacent overflows are not detected
Solution Approach 1:
The patent introduces poison pointers as an intermediary mechanism between pointer arithmetic and dereference operations. When pointer arithmetic produces an out-of-bounds result, the pointer is marked as poisoned rather than immediately generating a fault. This intermediary approach enables detection of non-adjacent overflows that would otherwise skip past buffer ends, while maintaining relative simplicity through the use of existing pointer infrastructure
3Reliability
If pointer arithmetic is instrumented with bounds checking, then non-adjacent overflows are prevented, but device complexity increases
Solution Approach 1:
The patent applies different checking strategies to different pointer states and operations. Poison pointers are used specifically for detecting non-adjacent overflows during arithmetic operations, while traditional bounds checking remains active for dereference operations. This localized application of different quality checks prevents unnecessary complexity in areas where simpler checks suffice, while enhancing security where needed
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed that perform bounds checking on authorized memory allocations during pointer arithmetic. In some examples, instruction decode circuitry decodes an update pointer instruction for a pointer. In some examples, bounds checking circuitry determines an authorized allocation for the pointer, determines one or more exclusion zones and poison zones for the pointer. In some examples, bounds checking circuitry updates the pointer and generates a fault if the pointer points to one of the exclusion zones and poisons the pointer if the pointer points to one of the poison zones.