Downloaded 10 times
![Detecting leaks is easy, fixing them is hard
@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
//[_object release];
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-22-2048.jpg)
![Detecting leaks is easy, fixing them is hard
@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
//[_object release];
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end
Container *create() {
Container *c =
[[Container alloc] init];
NSObject *o =
[[NSObject alloc] init];
[c setObject:o];
[o release];
return c;
}
int main(...) {
Container *c = create();
…
[c release];
}](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-23-2048.jpg)
![Detecting leaks is easy, fixing them is hard
@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
//[_object release];
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end
Container *create() {
Container *c =
[[Container alloc] init];
NSObject *o =
[[NSObject alloc] init];
[c setObject:o];
[o release];
return c;
}
int main(...) {
Container *c = create();
…
[c release];
}
leaks:
This object is leaked](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-24-2048.jpg)
![@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end
Container *create() {
Container *c =
[[Container alloc] init];
NSObject *o =
[[NSObject alloc] init];
[c setObject:o];
[o release];
return c;
}
int main(...) {
Container *c = create();
…
[c release];
}
Detecting leaks is easy, fixing them is easier](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-30-2048.jpg)
![@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end
Container *create() {
Container *c =
[[Container alloc] init];
NSObject *o =
[[NSObject alloc] init];
[c setObject:o];
[o release];
return c;
}
int main(...) {
Container *c = create();
…
[c release];
}
leakpoint:
This object is leaked
Detecting leaks is easy, fixing them is easier](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-31-2048.jpg)
![@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end
Container *create() {
Container *c =
[[Container alloc] init];
NSObject *o =
[[NSObject alloc] init];
[c setObject:o];
[o release];
return c;
}
int main(...) {
Container *c = create();
…
[c release];
}
leakpoint:
Last reference was lost here
leakpoint:
This object is leaked
Detecting leaks is easy, fixing them is easier](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-32-2048.jpg)
![@interface Container:NSObject {
id _object;
}
@end
@implementation Container
- (void) dealloc {
[super dealloc];
}
- (void) setObject:(id)obj {
[_object release];
_object = [obj retain];
}
@end
Container *create() {
Container *c =
[[Container alloc] init];
NSObject *o =
[[NSObject alloc] init];
[c setObject:o];
[o release];
return c;
}
int main(...) {
Container *c = create();
…
[c release];
}
[_object release];
leakpoint:
Last reference was lost here
leakpoint:
This object is leaked
Detecting leaks is easy, fixing them is easier](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-33-2048.jpg)
![Lost pointer to 0x1C93AC0 (16 bytes)
allocated at:
at calloc+105
by _internal_class_createInstanceFromZone+149
by _internal_class_createInstance+31
by +[NSObject allocWithZone:]+155 (NSObject.m:445)
by +[NSObject alloc]+41 (NSObject.m:432)
by create+97 (main.m:29)
by main+17 (main.m:38)
leaked at:
at free+103
by _internal_object_dispose+81
by NSDeallocateObject+223 (NSObject.m:207)
by -[Container dealloc]+53 (container.m:13)
by main+43 (main.m:40)
Leakpoint implementation
• Implemented as aValgrind tool (www.valgrind.org)
■ intercept libc memory management functions
■ instrument binary instructions to perform propagation](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-35-2048.jpg)
![leaks
Lost pointer to 0x1C93AC0 (16 bytes)
allocated at:
at calloc+105
by _internal_class_createInstanceFromZone+149
by _internal_class_createInstance+31
by +[NSObject allocWithZone:]+155 (NSObject.m:445)
by +[NSObject alloc]+41 (NSObject.m:432)
by create+97 (main.m:29)
by main+17 (main.m:38)
leaked at:
at free+103
by _internal_object_dispose+81
by NSDeallocateObject+223 (NSObject.m:207)
by -[Container dealloc]+53 (container.m:13)
by main+43 (main.m:40)
Leakpoint implementation
• Implemented as aValgrind tool (www.valgrind.org)
■ intercept libc memory management functions
■ instrument binary instructions to perform propagation](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-36-2048.jpg)
![leakpoint
leaks
Lost pointer to 0x1C93AC0 (16 bytes)
allocated at:
at calloc+105
by _internal_class_createInstanceFromZone+149
by _internal_class_createInstance+31
by +[NSObject allocWithZone:]+155 (NSObject.m:445)
by +[NSObject alloc]+41 (NSObject.m:432)
by create+97 (main.m:29)
by main+17 (main.m:38)
leaked at:
at free+103
by _internal_object_dispose+81
by NSDeallocateObject+223 (NSObject.m:207)
by -[Container dealloc]+53 (container.m:13)
by main+43 (main.m:40)
Leakpoint implementation
• Implemented as aValgrind tool (www.valgrind.org)
■ intercept libc memory management functions
■ instrument binary instructions to perform propagation](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-37-2048.jpg)
![A real leak?: _NSImageMalloc
void *_NSImageMalloc(NSZone* zone, size_t size) {
// allocate storage aligned to 32 bytes. we do this by
// allocating an extra 32 bytes, finding the address in the proper
// location and storing the delta in one of the previous 32 bytes.
void *unaligned = NSZoneMalloc(zone, size + BITMAP_DATA_ALIGNMENT);
if(unaligned != NULL) {
uintptr_t aligned = ((uintptr_t)unaligned + BITMAP_DATA_ALIGNMENT)
& ~(BITMAP_DATA_ALIGNMENT - 1);
(unsigned char*)aligned[-1] = aligned - (uintptr_t) unaligned;
return (void*)aligned;
}
else {
return NULL;
}
}](https://image.slidesharecdn.com/apple2008-130605203300-phpapp02/75/Advanced-Dynamic-Analysis-for-Leak-Detection-Apple-Internship-2008-47-2048.jpg)
Uploaded byJames Clause
Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
The document discusses advanced dynamic analysis techniques for leak detection. It describes how dynamic taint analysis works by assigning taint marks, propagating those marks, and checking the marks. This allows detecting where memory was allocated but not freed. The document outlines an implementation of leak detection as a Valgrind tool that intercepts memory functions and instruments instructions. It summarizes the current status of handling different languages and platforms. Future work ideas include improving the leakpoint tool and collaborating with Apple on new analysis techniques based on the experiences gained.
More Related Content
Similar to Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Advanced Dynamic Analysis for Leak Detection (Apple Internship 2008)
- 1. Advanced dynamic analysis forleak detection Jim Clause Chris Friesen - Manager Analysis Tools Group
- 2. Current analysis tools SharkInstruments
- 3. ≈ X-ray Current analysis tools SharkInstruments
- 4. ≈ X-ray MRI Current analysis tools SharkInstruments
- 5. ≈ X-ray MRI Current analysis tools SharkInstruments ≈?
- 6. ≈ X-ray MRI Current analysis tools SharkInstruments C A B 312 Z 3 Dynamic taint analysis ≈
- 7.
- 8. Dynamic taint analysis 1Assign taint marks C A B Z
- 9. Dynamic taint analysis 1Assign taint marks C A B 312 Z
- 10. Dynamic taint analysis 1Assign taint marks 2 Propagate taint marks C A B 312 Z
- 11. Dynamic taint analysis 1Assign taint marks 2 Propagate taint marks C A B 312 Z
- 12. Dynamic taint analysis 1Assign taint marks 3 Check taint marks 2 Propagate taint marks C A B 312 Z
- 13. Dynamic taint analysis 1Assign taint marks 3 Check taint marks 2 Propagate taint marks C A B 312 Z C A B 312 Z 3
- 14. Attack detection /prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errors
- 15. Attack detection /prevention Prevent stack smashing, SQL injection, buffer overruns, etc. Attack detection / prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errors
- 16. Information policy enforcement ensureclassified information does not leave the system Attack detection / prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errors
- 17. Testing Coverage metrics, testdata generation heuristic, etc. ✔/✘ Attack detection / prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errors
- 18. Data lifetime track howlong sensitive data remain in the application Attack detection / prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errors
- 19. Attack detection /prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errorsMemory errors Detect illegal memory access, leak detection, etc.
- 20. Attack detection /prevention Information policy enforcement Testing Data lifetime Applications of dynamic tainting Memory errorsMemory errors Detect illegal memory access, leak detection, etc.leak detection
- 21. Detecting leaks iseasy, fixing them is hard
- 22. Detecting leaks iseasy, fixing them is hard @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { //[_object release]; [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end
- 23. Detecting leaks iseasy, fixing them is hard @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { //[_object release]; [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c; } int main(...) { Container *c = create(); … [c release]; }
- 24. Detecting leaks iseasy, fixing them is hard @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { //[_object release]; [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c; } int main(...) { Container *c = create(); … [c release]; } leaks: This object is leaked
- 25. Leakpoint overview Discover wherethe last pointer to un-freed memory is lost
- 26. Leakpoint overview Assign taint marks Propagate taintmarks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 1 1 1 Discover where the last pointer to un-freed memory is lost
- 27. Leakpoint overview Assign taint marks Propagate taintmarks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 2 1 1 1 1 2 2 2 1 1 2 2 Discover where the last pointer to un-freed memory is lost
- 28. Leakpoint overview Assign taint marks Propagate taintmarks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 2 1 1 1 1 2 2 2 1 1 2 2 In general propagation follows standard pointer arithmetic rules Discover where the last pointer to un-freed memory is lost
- 29. Leakpoint overview Assign taint marks Propagate taintmarks Check taint marks ptr1 = malloc(...) ➔ ptr1 ptr2 = calloc(...) ➔ ptr2 ptr3 = ptr1 ➔ ptr3 , ptr1 ptr1 = NULL ➔ ptr1 , ptr3 ptr4 = ptr2 + 1 ➔ ptr4 , ptr2 Report error if taint mark’s count is zero and memory has not been freed. 2 3 1 1 1 1 2 2 2 1 1 2 2 In general propagation follows standard pointer arithmetic rules Discover where the last pointer to un-freed memory is lost
- 30. @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c; } int main(...) { Container *c = create(); … [c release]; } Detecting leaks is easy, fixing them is easier
- 31. @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c; } int main(...) { Container *c = create(); … [c release]; } leakpoint: This object is leaked Detecting leaks is easy, fixing them is easier
- 32. @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c; } int main(...) { Container *c = create(); … [c release]; } leakpoint: Last reference was lost here leakpoint: This object is leaked Detecting leaks is easy, fixing them is easier
- 33. @interface Container:NSObject { id _object; } @end @implementation Container - (void) dealloc { [super dealloc]; } - (void) setObject:(id)obj { [_object release]; _object = [obj retain]; } @end Container *create() { Container *c = [[Container alloc] init]; NSObject *o = [[NSObject alloc] init]; [c setObject:o]; [o release]; return c; } int main(...) { Container *c = create(); … [c release]; } [_object release]; leakpoint: Last reference was lost here leakpoint: This object is leaked Detecting leaks is easy, fixing them is easier
- 34. Leakpoint implementation • Implementedas aValgrind tool (www.valgrind.org) ■ intercept libc memory management functions ■ instrument binary instructions to perform propagation
- 35. Lost pointer to0x1C93AC0 (16 bytes) allocated at: at calloc+105 by _internal_class_createInstanceFromZone+149 by _internal_class_createInstance+31 by +[NSObject allocWithZone:]+155 (NSObject.m:445) by +[NSObject alloc]+41 (NSObject.m:432) by create+97 (main.m:29) by main+17 (main.m:38) leaked at: at free+103 by _internal_object_dispose+81 by NSDeallocateObject+223 (NSObject.m:207) by -[Container dealloc]+53 (container.m:13) by main+43 (main.m:40) Leakpoint implementation • Implemented as aValgrind tool (www.valgrind.org) ■ intercept libc memory management functions ■ instrument binary instructions to perform propagation
- 36. leaks Lost pointer to0x1C93AC0 (16 bytes) allocated at: at calloc+105 by _internal_class_createInstanceFromZone+149 by _internal_class_createInstance+31 by +[NSObject allocWithZone:]+155 (NSObject.m:445) by +[NSObject alloc]+41 (NSObject.m:432) by create+97 (main.m:29) by main+17 (main.m:38) leaked at: at free+103 by _internal_object_dispose+81 by NSDeallocateObject+223 (NSObject.m:207) by -[Container dealloc]+53 (container.m:13) by main+43 (main.m:40) Leakpoint implementation • Implemented as aValgrind tool (www.valgrind.org) ■ intercept libc memory management functions ■ instrument binary instructions to perform propagation
- 37. leakpoint leaks Lost pointer to0x1C93AC0 (16 bytes) allocated at: at calloc+105 by _internal_class_createInstanceFromZone+149 by _internal_class_createInstance+31 by +[NSObject allocWithZone:]+155 (NSObject.m:445) by +[NSObject alloc]+41 (NSObject.m:432) by create+97 (main.m:29) by main+17 (main.m:38) leaked at: at free+103 by _internal_object_dispose+81 by NSDeallocateObject+223 (NSObject.m:207) by -[Container dealloc]+53 (container.m:13) by main+43 (main.m:40) Leakpoint implementation • Implemented as aValgrind tool (www.valgrind.org) ■ intercept libc memory management functions ■ instrument binary instructions to perform propagation
- 38.
- 39. Leakpoint: current status Handlebasic C / C++ / Objective C
- 40. Leakpoint: current status Handlebasic C / C++ / Objective C✔
- 41. Leakpoint: current status Handlebasic C / C++ / Objective C✔ Handle CoreFoundation
- 42. Leakpoint: current status Handlebasic C / C++ / Objective C✔ Handle CoreFoundation✔
- 43. Leakpoint: current status Handlebasic C / C++ / Objective C Handle Cocoa ✔ Handle CoreFoundation✔
- 44. Need to investigateapproximately 40 false positive (probably) leak reports • Interface Builder unarchiving • CoreData Leakpoint: current status Handle basic C / C++ / Objective C Handle Cocoa ✔ Handle CoreFoundation✔
- 45. Need to investigateapproximately 40 false positive (probably) leak reports • Interface Builder unarchiving • CoreData Leakpoint: current status Handle basic C / C++ / Objective C Handle Cocoa ✔ Handle CoreFoundation✔ 64bit compatible
- 46. Need to investigateapproximately 40 false positive (probably) leak reports • Interface Builder unarchiving • CoreData Leakpoint: current status Handle basic C / C++ / Objective C Handle Cocoa ✔ Handle CoreFoundation✔ 64bit compatible✔
- 47. A real leak?:_NSImageMalloc void *_NSImageMalloc(NSZone* zone, size_t size) { // allocate storage aligned to 32 bytes. we do this by // allocating an extra 32 bytes, finding the address in the proper // location and storing the delta in one of the previous 32 bytes. void *unaligned = NSZoneMalloc(zone, size + BITMAP_DATA_ALIGNMENT); if(unaligned != NULL) { uintptr_t aligned = ((uintptr_t)unaligned + BITMAP_DATA_ALIGNMENT) & ~(BITMAP_DATA_ALIGNMENT - 1); (unsigned char*)aligned[-1] = aligned - (uintptr_t) unaligned; return (void*)aligned; } else { return NULL; } }
- 48. Overhead Powerful but expensive 50-100x overheads are common
- 49. Overhead Powerful but expensive 50-100x overheads are common Recommended usage: run cheap tools to check for errors run expensive tools to diagnose errors
- 50.
- 51.
- 52. Future work • Apple ■new leak detection tool ■ experience with dynamic taint analysis Impact + Leakpoint ( )
- 53. Future work • Apple ■new leak detection tool ■ experience with dynamic taint analysis • Me ■ experience withValgrind ■ experience analyzing large commercial code base Impact + Leakpoint ( )
- 54.