A Formal Model of Checked C

We present a formal model of Checked C, a dialect of C that aims to enforce spatial memory safety. Our model pays particular attention to the semantics of dynamically sized, potentially null-terminated arrays. We formalize this model in Coq, and prove that any spatial memory safety errors can be bla...

Full description

Saved in:
Bibliographic Details
Published in2022 IEEE 35th Computer Security Foundations Symposium (CSF) pp. 49 - 63
Main Authors Li, Liyi, Liu, Yiyun, Postol, Deena, Lampropoulos, Leonidas, Van Horn, David, Hicks, Michael
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.08.2022
Subjects
Analytical models
Annotations
C Semantics
Checked C
Codes
compiler verification
Computational modeling
Generators
Memory Safety
Safety
Semantics
Spatial Safety
static analysis
type soundness
Online AccessGet full text

Cover

More Information
Summary:We present a formal model of Checked C, a dialect of C that aims to enforce spatial memory safety. Our model pays particular attention to the semantics of dynamically sized, potentially null-terminated arrays. We formalize this model in Coq, and prove that any spatial memory safety errors can be blamed on portions of the program labeled unchecked; this is a Checked C feature that supports incremental porting and backward compatibility. While our model's operational semantics uses annotated ("fat") pointers to enforce spatial safety, we show that such annotations can be safely erased. Using PLT Redex we formalize an executable version of our model and a compilation procedure to an untyped C-like language, as well as use randomized testing to validate that generated code faithfully simulates the original. Finally, we develop a custom random generator for well-typed and almost-well-typed terms in our Redex model, and use it to search for inconsistencies between our model and the Clang Checked C implementation. We find these steps to be a useful way to co-develop a language (Checked C is still in development) and a core model of it.
DOI:10.1109/CSF54842.2022.9919657