View in EDS

Static analysis to make the most of CHERI C/C++ for existing code: improving memory safety at scale.

Saved in:
Bibliographic Details
Title: Static analysis to make the most of CHERI C/C++ for existing code: improving memory safety at scale.
Authors: Dudina, Irina1 (AUTHOR) irina.dudina@ed.ac.uk, Stark, Ian1 (AUTHOR) ian.stark@ed.ac.uk
Source: International Journal on Software Tools for Technology Transfer. Apr2025, Vol. 27 Issue 2, p225-237. 13p.
Subjects: Spatial memory, Checkers, Integers, Memory, Computer software
Abstract: We describe and evaluate custom static analyses to support transitioning existing C/C++ codebases to CHERI hardware. CHERI is a novel architectural extension, implemented for RISC-V and AArch64, that uses capabilities to provide fine-grained memory protection and scalable software compartmentalization. While the existing CHERI toolchain can recompile large code collections for the platform with only a few source changes, those changes are nonetheless critical: we demonstrate that static analysis can help to identify where they are needed and what must be done to avoid later runtime faults. We provide custom checkers for the Clang Static Analyzer to handle capability alignment, copying through memory, and manipulation as integers. Beyond simply picking up problems in existing code, we also have checkers that identify where code can take advantage of capabilities to better enforce least privilege and improve spatial memory safety. We evaluate all implemented checkers on a sample of packages from the CheriBSD ports library (408 packages, analyzed) and confirm by analyzing true-positive warning rates that the reports produced are sufficiently high quality for practical use. [ABSTRACT FROM AUTHOR]
Copyright of International Journal on Software Tools for Technology Transfer is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database: Engineering Source
FullText Text:
  Availability: 0
Header DbId: egs
DbLabel: Engineering Source
An: 185858262
AccessLevel: 6
PubType: Academic Journal
PubTypeId: academicJournal
PreciseRelevancyScore: 0
IllustrationInfo
Items – Name: Title
  Label: Title
  Group: Ti
  Data: Static analysis to make the most of CHERI C/C++ for existing code: improving memory safety at scale.
– Name: Author
  Label: Authors
  Group: Au
  Data: <searchLink fieldCode="AR" term="%22Dudina%2C+Irina%22">Dudina, Irina</searchLink><relatesTo>1</relatesTo> (AUTHOR)<i> irina.dudina@ed.ac.uk</i><br /><searchLink fieldCode="AR" term="%22Stark%2C+Ian%22">Stark, Ian</searchLink><relatesTo>1</relatesTo> (AUTHOR)<i> ian.stark@ed.ac.uk</i>
– Name: TitleSource
  Label: Source
  Group: Src
  Data: <searchLink fieldCode="JN" term="%22International+Journal+on+Software+Tools+for+Technology+Transfer%22">International Journal on Software Tools for Technology Transfer</searchLink>. Apr2025, Vol. 27 Issue 2, p225-237. 13p.
– Name: Subject
  Label: Subjects
  Group: Su
  Data: <searchLink fieldCode="DE" term="%22Spatial+memory%22">Spatial memory</searchLink><br /><searchLink fieldCode="DE" term="%22Checkers%22">Checkers</searchLink><br /><searchLink fieldCode="DE" term="%22Integers%22">Integers</searchLink><br /><searchLink fieldCode="DE" term="%22Memory%22">Memory</searchLink><br /><searchLink fieldCode="DE" term="%22Computer+software%22">Computer software</searchLink>
– Name: Abstract
  Label: Abstract
  Group: Ab
  Data: We describe and evaluate custom static analyses to support transitioning existing C/C++ codebases to CHERI hardware. CHERI is a novel architectural extension, implemented for RISC-V and AArch64, that uses capabilities to provide fine-grained memory protection and scalable software compartmentalization. While the existing CHERI toolchain can recompile large code collections for the platform with only a few source changes, those changes are nonetheless critical: we demonstrate that static analysis can help to identify where they are needed and what must be done to avoid later runtime faults. We provide custom checkers for the Clang Static Analyzer to handle capability alignment, copying through memory, and manipulation as integers. Beyond simply picking up problems in existing code, we also have checkers that identify where code can take advantage of capabilities to better enforce least privilege and improve spatial memory safety. We evaluate all implemented checkers on a sample of packages from the CheriBSD ports library (408 packages, analyzed) and confirm by analyzing true-positive warning rates that the reports produced are sufficiently high quality for practical use. [ABSTRACT FROM AUTHOR]
– Name: AbstractSuppliedCopyright
  Label:
  Group: Ab
  Data: <i>Copyright of International Journal on Software Tools for Technology Transfer is the property of Springer Nature and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.)
PLink https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=egs&AN=185858262
RecordInfo BibRecord:
  BibEntity:
    Identifiers:
      – Type: doi
        Value: 10.1007/s10009-025-00781-6
    Languages:
      – Code: eng
        Text: English
    PhysicalDescription:
      Pagination:
        PageCount: 13
        StartPage: 225
    Subjects:
      – SubjectFull: Spatial memory
        Type: general
      – SubjectFull: Checkers
        Type: general
      – SubjectFull: Integers
        Type: general
      – SubjectFull: Memory
        Type: general
      – SubjectFull: Computer software
        Type: general
    Titles:
      – TitleFull: Static analysis to make the most of CHERI C/C++ for existing code: improving memory safety at scale.
        Type: main
  BibRelationships:
    HasContributorRelationships:
      – PersonEntity:
          Name:
            NameFull: Dudina, Irina
      – PersonEntity:
          Name:
            NameFull: Stark, Ian
    IsPartOfRelationships:
      – BibEntity:
          Dates:
            – D: 01
              M: 04
              Text: Apr2025
              Type: published
              Y: 2025
          Identifiers:
            – Type: issn-print
              Value: 14332779
          Numbering:
            – Type: volume
              Value: 27
            – Type: issue
              Value: 2
          Titles:
            – TitleFull: International Journal on Software Tools for Technology Transfer
              Type: main
ResultId 1