The document discusses using static analysis techniques like pointer analysis to detect bugs involving stale pointers. It presents an approach that first converts programs to SSA form and then performs intraprocedural and interprocedural pointer analysis to track pointer aliases and detect when pointers may be used after the memory they point to has been freed or reallocated. The analysis combines dataflow and abstract interpretation to build and propagate pointer alias information within and across functions to find potential stale pointer bugs.

1. Stale
pointers
are
the
new
black
Vincenzo
Iozzo,
Giovanni
Gola
vincenzo.iozzo@zynamics.com
giovanni.gola@mail.polimi.it

2. Disclaimer
In
this
talk
you
won’t
see
all
those
formulas,
formal
definiEon,
code
snippets
and
bullets.
From
past
experiences
the
speaker
learned
that
all
the
aforemenEoned
elements
are
no
useful
in
making
people
understand
your
idea.
You
instead
will
see
a
lot
of
funny
pictures
which
the
speaker
hopes
will
convey
beHer
the
understanding
of
the
ideas
explained
in
the
talk
You
don’t
want
slides
like
this,
do
you?

3. Stale
pointers
are
the
new
black

4. MoEvaEons

5. Different
approaches
then..

6. ..
Or
StaEc
Analysis!
• Dataflow
analysis
• Model
Checking
• Theorem
Proving

7. Our
Idea

8. How
it
works
Intraprocedural
Interprocedural
SSA
Form
Bug
detecEon
pointer
analysis
pointer
analysis

9. Single
StaEc
Assignment
Form

10. Example
mov
eax,
0x40
mov
eax,
0x100
mov
ebx,
0x2
cmp
ecx,
edx
Jle
1
mov
ebx,
0x4
mov
ebx,
0x20

11. Looks
beHer,
right?
mov
eax_0,
0x40
mov
eax_1,
0x100
mov
ebx_0,
0x2
cmp
ecx,
edx
Jle
1
mov
ebx_1,
0x4
mov
ebx_2,
0x20

12. How
about
now?
mov
eax_0,
0x40
Mov
eax_1,
0x100
Mov
ebx_0,
0x2
cmp
ecx,
edx
Jle
1
mov
ebx_1,
0x4
mov
ebx_2,
0x20
mov
ecx,
ebx_?

13. Tah-­‐dah!
mov
eax_0,
0x40
mov
eax_1,
0x100
mov
ebx_0,
0x2
cmp
ecx,
edx
Jle
1
mov
ebx_1,
0x4
mov
ebx_2,
0x20
mov
0x4,
ebx_return_from_phi

14. Intermediate
language
interlude

15. Enter
REIL
A
small
introducEon
to
the
REIL
meta
language
• small
RISC
instrucEon
set
(17
instrucEons)
• ArithmeEc
instrucEons
(ADD,
SUB,
MUL,
DIV,
MOD,
BSH)
• Bitwise
instrucEons
(AND,
OR,
XOR)
• Logical
instrucEons
(BISZ,
JCC)
• Data
transfer
instrucEons
(LDM,
STM,
STR)
• Other
instrucEons
(NOP,
UNDEF,
UNKN)
• register
machine
• unlimited
number
of
temp
registers
• side
effect
free
• no
excepEons,
floaEng
point,
64Bit,
..

16. Example

17. Translated

18. Back
to
SSA

19. Flavours
• Non-­‐pruned
• Semi-­‐pruned
• Pruned

20. Non-­‐locals
ldm
0x1000,
t0
add
t0,
t1,
t2
ldm
t2,
,
t3
t0
is
a
non-­‐ ldm
t0,
t4
local

21. Algorithm
• Find
non-­‐locals
• Place
phi-­‐funcEons
• Recursively
rename
variables

22. A
funcEon

23. In
SSA
Form

24. Detour..
Abstract
interpretaEon

25. Abstract
InterpretaEon

26. Abstract
InterpretaEon..
formally
Give
several
semanEcs
linked
by
relaEons
of
abstracEon

27. MonoREIL

28. So
what
you
need?
• The
control
flow
graph
of
a
funcEon
• A
way
to
walk
the
CFG
• The
lahce
– Its
elements
– A
way
to
combine
lahce
elements
• An
iniEal
state
• REIL
instrucEons
effects
on
the
lahce

29. One
constraint!
The
lahce
has
to
saEsfy
the
ascending
chain
condiEon

30. Now
the
analysis
itself

31. Intraprocedural
Analysis
• Pointer
Analysis:
Efficiency
• Shape
Analysis:
Precision
• Alias
Set
Analysis:
Tradeoff
between
the
two

32. Data
Structures
• push()
and
pop()
on
linked
lists:
30%
faster
• Hash
consing:
30%
memory
saving

33. Transfer
FuncEons

34. combine()
• Filter
out
non-­‐live
variables
from
each
alias
list:
• live-­‐out(inst)
⊆
vars(dom(inst))
• Alias
list
∩
vars(sdom(Φ)):
• pop()
from
the
list
unEl
top(alias
list)
∈
vars(sdom(Φ))
• Add
aliases
defined
by
Φ
funcEons
• Unite
the
sets
of
lists

35. Data
Structures
Again

36. Example

37. Tracking
parameters
and
return
• IDA
effecEvely
tracks
parameters
• return
is
idenEfied
by
guessing
the
calling
convenEon

38. Interprocedural
Analysis

39. Algorithm
• Flow-­‐insensiEve
• Context-­‐sensiEve
• Implemented
in
BinNavi:
• walks
on
the
PCG

40. Procedure
Call
Graph

41. TransformaEons

42. TransformaEons

43. TransformaEons

44. TransformaEons

45. combine()

46. Bug
DetecEon

47. Callgraph
pruning

48. Callgraph
pruning

49. Callgraph
pruning

50. Marking
destructor()
calls

51. Algorithm
v
is
a
tracked
alias
•
X
is
a
basic
block
of
F
that
calls
the
destructor
•
• B
is
a
basic
block
of
F
that
accesses
v
or
calls
a
funcEon
that
accesses
v
• Verify
the
following:
 if
B
∈
dom(X)
⇒
v
is
a
stale
pointer
 if
B
!∈
dom(X)
∧
B
∈
succ(X)
⇒
v
may
be
a
stale
pointer
 if
X
!∈
dom(B)
∧
X
∈
succ(B)
⇒
v
may
cause
memory
leak
• if
X
!∈
dom(B)
∧
X
!∈
succ(B)
⇒
v
causes
memory
leak
Iterate
subsEtuEng:
•
• F
with
each
of
its
callers
• X
with
a
basic
block
that
calls
F

52. Example
No
bugs

53. Example
No
bugs

54. Example
Use
amer
free
bug

55. Example
Use
amer
free
bug

56. Example
Use
amer
free
bug
(maybe)

57. Example
Use
amer
free
bug
(maybe)

58. Example
No
bugs

59. Example
Use
amer
free
bug

60. Example
Use
amer
free
bug
(maybe)

61. What’s
the
catch
• We
cannot
handle
all
data
structures
• We
cannot
handle
funcEon
pointers
• We
have
false
posiEves
• We
have
false
negaEves
• Some
“smart
pointers”-­‐like
interfaces
might
not
be
covered
• The
best
use
is
for
C++
life-­‐span
issues

62. Future
• Increase
the
number
of
covered
data
structure
• Use
a
solver
to
reduce
false
posiEves
• Import
dynamic
analysis
data
to
miEgate
the
funcEon
pointers
problem

63. That’s
all
folks