TAILCHECK: A Lightweight Heap Overflow Detection Mechanism with Page Protection and...
summary
Implements a runtime that pairs each allocation with a page-aligned shadow TailObject and stores the distance to that shadow in the pointer’s high bits as a 16-bit tag (≈64KB); every load/store is duplicated (via LLVM LTO instrumentation) to the shadow so overruns hit a guard page and raise a fault. Prototype handles large objects by falling back to per-allocation guards, finds a real overflow in SPEC CPU2017 gcc, and measures ~4% average / 2% 99th-percentile latency overhead on servers and ~33% / ~29% on SPEC suites while reducing memory and runtime cost versus prior guard- and metadata-based approaches.
AI-written summary · about
chapters (14)
- 0:00TAILCHECK introduction
- 0:17Heap overflow dangers and solutions
- 2:03Guard pages and bounds check limits
- 3:06Pointer tagging and TAILCHECK
- 4:30TAILCHECK design and allocator changes
- 5:54Shared tail objects optimization
- 7:39Large objects and fallback handling
- 8:20Compiler dereference duplication
- 9:24LLVM optimizations for TAILCHECK
- 10:47Evaluation setup and benchmarks
- 11:30Security evaluation and vulnerabilities
- 11:52Performance impact on servers
- 12:55Delta Pointers comparison
- 13:38Conclusion and TAILCHECK benefits
related talks
36mStore-to-Leak Forwarding: There and Back Again
22mGuarder: A Tunable Secure Allocator
32mPoking Holes in Information Hiding
22mHeapHopper: Bringing Bounded Model Checking to Heap Implementation Security
26mTowards Efficient Heap Overflow Discovery
17mFat Pointers for Temporal Memory Safety of C
37mHeap Layout Optimisation for Exploitation
15mMemoryTrap: Booby Trapping Memory to Counter Memory Disclosure Attacks with...