5e: Memory Corruption Detection for the Rest of Us - Ori Bernstein
0:28 5eV: A Valgrind-like tool for ARM: Ori introduces 5eV, a fork of the 5e ARM emulator designed to incorporate memory error detection similar to Valgrind.
1:25 Memory Errors in C: Ori highlights the prevalence of memory errors in C programming, such as segmentation faults, out-of-bounds reads/writes, and accessing uninitialized memory.
3:00 Traditional Plan 9 vs. Rest of the World: Plan 9's approach to memory safety relies on programmer discipline, while other environments utilize tools like Valgrind and Address Sanitizer.
3:30 Valgrind & Address Sanitizer: Valgrind emulates the target architecture to check memory accesses, while Address Sanitizer uses compiler instrumentation and a shadow map.
5:40 5eV's Approach: 5eV combines emulation with a shadow map concept, similar to Address Sanitizer, to track memory state without impacting the emulated program's address space.
6:01 Shadow Map Explained: The shadow map assigns a few bits of state (allocated, initialized) to every few bytes of memory in the program's segments (text, data, BSS, stack).
8:09 Example: Memory Allocation and Access: Ori illustrates how 5eV tracks memory state using the shadow map during malloc, initialization, and out-of-bounds access scenarios.
11:57 Current Limitations: 5eV lacks a reliable way to determine stack size during function calls, hindering accurate stack memory tracking upon return. It also doesn't handle the APE allocator or add red zones around variables for detecting overflows between adjacent objects.
15:56 Future Enhancements: Ori plans to either expand the shadow map to tag objects or modify the compiler to insert padding between objects to address the red zone issue. Other potential additions include thread safety analysis (similar to Thread Sanitizer) and migrating the instrumentation to the linker.
16:42 Linker Integration: Ori suggests that integrating the memory safety checks into the linker could offer performance advantages over the emulator-based approach, potentially reducing the slowdown from 100x to 2x. The linker also has inherent knowledge of stack sizes, facilitating accurate stack memory tracking.
18:23 Current Usefulness: Despite being a work in progress, 5eV has proven helpful in debugging small programs.
18:46 Q&A: Ori clarifies that 5eV currently emulates ARM because a suitable emulator with necessary memory access hooks was readily available. He acknowledges the potential for significant binary size increases with the linker-based approach, estimating a 2-3x growth.