Software Memory Tagging for Low-Overhead Heap Overflow Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing buffer overflow protection methods, such as hardware memory tagging and page heap, are not compatible with 32-bit and 64-bit operating systems, and solutions like Address Sanitizer (ASAN) incur significant performance degradation.
Innovation Solution
A software-based buffer overflow protection system using a bit map to maintain disjoint heap memory allocations, where each allocation is assigned a unique tag value, allowing for efficient detection of buffer overflows by comparing tag values during memory write operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware memory tagging or page heap is used for buffer overflow protection, then buffer overflow detection capability is improved, but compatibility with 32-bit and 64-bit operating systems deteriorates
Solution Approach 1:
The patent replaces hardware-based memory tagging mechanisms with a software-based solution that uses a bit map data structure to track heap memory allocations. Instead of relying on hardware features that are incompatible with certain operating systems, the invention uses software instructions to read and compare tag values from the bit map, achieving buffer overflow detection across 32-bit and 64-bit systems without hardware dependencies
Solution Approach 2:
The patent introduces a bit map as an intermediary data structure that mediates between the heap memory allocations and the buffer overflow detection mechanism. The bit map stores tag values for each heap allocation and serves as the intermediary that the software reads to determine whether a buffer overflow has occurred, enabling compatibility across different operating system architectures
2Reliability
If Address Sanitizer (ASAN) is used for buffer overflow protection, then buffer overflow detection capability is improved, but processing performance deteriorates
Solution Approach 1:
The patent extracts only the essential tag comparison functionality needed for buffer overflow detection, separating it from the comprehensive but performance-heavy Address Sanitizer system. By using a simple bit map with tag values and performing minimal comparisons during memory operations, the invention achieves buffer overflow detection with significantly reduced processing overhead compared to full ASAN instrumentation
Solution Approach 2:
The patent performs partial checking by comparing tag values only for the specific memory addresses involved in each allocation and deallocation operation, rather than performing exhaustive checks on all memory accesses. This partial action approach maintains adequate security while minimizing the performance impact on normal program execution
3Reliability
If traditional buffer overflow protection methods are used, then security against buffer overflow is improved, but memory overhead increases
Solution Approach 1:
The patent applies local quality by using a bit map where each bit represents the tag value for a specific heap allocation. This localized approach stores only the necessary tag information at the appropriate memory locations rather than using comprehensive protection structures, reducing overall memory overhead while maintaining security
Solution Approach 2:
The patent changes the parameter representation by using single-bit tag values in the bit map instead of larger data structures. By encoding heap allocation tags as individual bits rather than using complex metadata structures, the invention significantly reduces the memory overhead required for buffer overflow protection
Data Source
AI summary
Generally discussed herein are devices, systems, and methods for software memory tagging that provides buffer overflow protection. A method can include responsive to a memory write operation to write data to a heap of a memory, identifying a first tag value associated with a first address of the memory write operation in the bit map, comparing, for each address after the first address affected by the memory write operation, respective tag values in a bit map of the memory to the identified first tag value, and halting execution of the application if any of the respective tag values do not match the first tag value.