SANRAZOR: Reducing Redundant Sanitizer Checks in C/C++ Programs
Talkat 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI '21) · 2021-07-14..07-16·
summary
SanRazor is a tool that identifies and removes redundant sanitizer checks by combining dynamic coverage profiles with static data-dependency trees, instruments LLVM IR checks, and rewrites branches to eliminate redundant checks. It reports concrete payoffs: reduces AddressSanitizer overhead from 73.8% to 28.0–62.0% and reduces UBSan overhead from 160.1% to 36.6–124.4%, removes up to ~30–39% of checks, and still detects at least 33 of 38 CVEs; combining with ASAP drops overhead to about 7%.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:37C/C++ programs are unsafe
- 0:54Sanitizers are designed to detect software bugs/vulnerabilities
- 1:10However, sanitizers have high runtime overhead
- 1:48Prior approaches
- 2:14Our novel design
- 2:32Design: overall workflow
- 3:17Design: check identification
- 3:51Design: dynamic pattern capturing
- 4:58Design: static pattern capturing
- 6:27Design: sanitizer check reduction
- 8:06Design and implementation
- 8:28Evaluation cost study
- 10:26Evaluation: vulnerability detectability study
- 11:45Application scenario
- 13:10Summary
related talks
01h 00mSanitize for your Sanity: Sanitizers tools for Modern C++
01h 02mSanitize your C++ code
59mBeyond Sanitizers...
16mSEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs
40mAddressSanitizer, or How to Make C/C++ Programs More Reliable and Secure
18mDon't Look UB: Exposing Sanitizer-Eliding Compiler Optimizations
36mCode Analysis: Empowering developers to write performant, reliable, and safe C++
40mBorrowSanitizer: Securing Rust Across Foreign Function Boundaries