一句话：通过胖指针结合动态键锁检查扩展 Checked C，高效且全面地保障 C 程序的时序内存安全。
时序内存安全缺陷（如 use-after-free 和 double free）是 C 程序面临的主要安全威胁，攻击者可借此读写任意内存。已有改造方案往往性能开销高或漏检部分缺陷。本文提出一种高效且全面的时序内存安全方案：扩展 Checked C（空间安全 C 扩展）以支持 temporally-safe 指针，通过胖指针与动态 key-lock 检查实现。评估表明，与提供同等保护的 disjoint-metadata 方案相比，该胖指针方案显著降低运行时间和内存开销；结合程序数据与真实应用移植经验，也说明其在向后兼容性方面具有实用性。
Temporal memory safety bugs, especially use-after-free and double free bugs, pose a major security threat to C programs. Real-world exploits utilizing these bugs enable attackers to read and write arbitrary memory locations, causing disastrous violations of confidentiality, integrity, and availability. Many previous solutions retrofit temporal memory safety to C, but they all either incur high performance overhead and/or miss detecting certain types of temporal memory safety bugs. In this paper, we propose a temporal memory safety solution that is both efficient and comprehensive. Specifically, we extend Checked C, a spatially-safe extension to C, with temporally-safe pointers. These are implemented by combining two techniques: fat pointers and dynamic key-lock checks. We show that the fat-pointer solution significantly improves running time and memory overhead compared to the disjoint-metadata approach that provides the same level of protection. With empirical program data and hands-on experience porting real-world applications, we also show that our solution is practical in terms of backward compatibility---one of the major complaints about fat pointers.
@article{paperbot2035,
title = {Fat Pointers for Temporal Memory Safety of C},
author = {Jie Zhou and John Criswell and Michael Hicks},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {OOPSLA1},
year = {2023},
doi = {10.1145/3586038}
}