Shadow Memory Encoding for Runtime Memory Safety Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory safety analysis tools are limited in their ability to detect memory violations, particularly when a program accesses memory through a pointer that does not point to the correct memory block, due to insufficient metadata capturing the bounds and length of allocated memory blocks.
Innovation Solution
A shadow memory encoding scheme that tracks the boundaries and lengths of allocated memory blocks by using primary and secondary shadow memory regions, where each byte in the application memory is mapped to corresponding bytes in the shadow memory, allowing for the encoding of memory block lengths, offsets, and initialization status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing memory safety analysis tools use simple shadow memory without block boundary tracking, then the device complexity is reduced, but the ability to detect memory violations through pointers is insufficient
Solution Approach 1:
The shadow memory is segmented into multiple regions: a first shadow memory region for tracking allocated blocks with boundaries and lengths, and a second shadow memory region for tracking uninitialized blocks. This segmentation allows the system to maintain comprehensive metadata for accurate memory safety detection while organizing complex information in a structured manner that improves manageability and processing efficiency.
2Measurement precision
If the shadow memory encodes detailed block metadata (length, offset, boundaries), then the measurement precision of memory access legality is improved, but the use of energy increases
Solution Approach 1:
The system changes the encoding parameters of shadow memory based on block characteristics. For allocated blocks, it stores length and boundary information; for uninitialized blocks, it uses a separate tracking mechanism. This parameter adaptation allows precise memory access validation while minimizing redundant data storage and processing, thereby reducing energy consumption during runtime analysis.
3Reliability
If the system tracks all memory blocks with full metadata, then the reliability of detecting improper pointer access is improved, but the productivity of runtime analysis is reduced
Solution Approach 1:
The system performs preliminary classification of memory blocks into allocated and uninitialized categories during allocation time, storing essential metadata (boundaries, lengths) in the first shadow memory region. This preliminary action enables fast runtime validation without requiring complex analysis during actual memory access checks, thus maintaining high reliability while improving productivity.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The invention proposes a method that allows tracking boundaries of allocated memory blocks while still capturing byte-level properties. This is achieved with a particular shadow memory encoding scheme which captures boundaries and lengths of allocated memory blocks. Analyzing the shadow memory state allows detecting memory safety issues. In particular, for a memory location given by its address a, the proposed invention allows computing the following information: whether a has been allocated, whether a has been initialized, the start (base) address of the memory block a belongs to, the byte-length of the memory block a belongs to, the byte offset of a within its block. Such information allows for detection of specific memory safety issues at runtime.