FRESH

Hacker News

Evaluating the Effectiveness of Memory Safety Sanitizers

44 points by signa11

by pizlonator

0 subcomment

Wait hold up the same authors did MESH: https://arxiv.org/pdf/2108.08683
So why isn't MESH part of the evaluation? And why isn't it mentioned even once in the paper?

by pizlonator

0 subcomment

I wonder if their test cases are available.
Fil-C is specifically engineered to catch everything so it would be interesting to check it against their tests

by rwmj

2 subcomments

I wonder how true the assertion "This performance is partly achieved by sacrificing memory safety" is today. I suspect a sufficiently advanced compiler can remove bounds checks where they are provably unnecessary, and a sufficiently advanced CPU can run the remaining checks in parallel with the array accesses. But it'd be interesting if there's been any research on that.
(A sufficiently advanced programming language can avoid the entire issue by writing loops as map, fold, etc. but we're talking about C here.)

by osivertsson

1 subcomments

Download possible without paywall from https://publica.fraunhofer.de/entities/publication/9d7783f8-...

by Ygg2

0 subcomment

Conclusion is scathing:
> The findings highlight significant variations in the theoretical detection capabilities of these techniques and reveal that, in practice, the implementations of most available sanitizers fall short of their conceptual potential. Furthermore, the evaluation demonstrates the complexities and diversity of memory bugs in C/C++, as well as the challenges associated with detecting them. For instance, our results show that SoftBound+CETS, a conceptually complete sanitizer, misses nearly a quarter of spatial memory bugs in its original implementation, while ASan, likely the most widely used memory sanitizer, cannot detect 50% of use-after-* bugs and any non-linear overflows and under- flows. Ultimately, our evaluation concludes that no sanitizer currently provides complete temporal or spatial memory safety

by ape4

1 subcomments

by bgwalter

0 subcomment

If SoftBound+CETS has the best results, why does Fraunhofer not sponsor the creation of a Debian package?
It is unmaintained:
https://github.com/Fraunhofer-AISEC/softboundcets

by lou1306

1 subcomments

Weird that Infer [1] was not included in the evaluation. It supports C/C++ and its underlying reasoning framework (Separation Logic [2]) is exactly geared towards checking memory safety.
[1] https://fbinfer.com/
[2] https://en.wikipedia.org/wiki/Separation_logic

by unpaydijk

2 subcomments