Memory Systems · Cluster
Memory Safety
Bounds, use-after-free, and mitigation strategies.
- 01 How an Out-of-Bounds Write Reaches Allocator Metadata Why the bytes just past a heap object belong to the allocator, how a single byte can turn a length field into an address, and which layouts keep bookkeeping out of the blast radius.
- 02 Use-After-Free and the Reuse That Conceals It What a dangling pointer actually refers to after the object dies, why an immediate reuse so often makes the bug invisible, and how quarantine and poisoning change the diagnosis.
- 03 Stack Canaries and What They Actually Detect How a random guard word between local buffers and saved control data turns a linear stack overflow into a detectable event, and which overflows it cannot see.
- 04 Double Free and the Integrity of Free Lists What the allocator does with a second release of the same block, why the list structure makes it dangerous, and how per-thread caches and consistency checks contain it.
- 05 AddressSanitizer and the Arithmetic of Shadow Memory How a one-eighth-scale shadow map turns every load and store into a validity query, what the poison values encode, and where the scheme cannot see.
- 06 Slice Bounds Checks and the Conditions for Eliding Them How a length-carrying descriptor makes every index a checked operation, what the branch costs when it is not removable, and which static facts let a compiler prove it away.
- 07 Shadow Stacks and Protecting the Return Address Why a parallel copy of the return address catches overflows that canaries miss, how the check is wired into the epilogue, and what the hardware support changes.
- 08 Memory Tagging and the Granule Trade-Off How a tag in the pointer and a tag in memory turn a stale or out-of-bounds access into a fault, why the granule size decides which bugs are visible, and what probabilistic checking buys.
- 09 Capability Machines and the CHERI Bounds Encoding How a pointer that carries its own bounds and permissions replaces a flat address space, what the compressed bounds cost in bits, and why the model makes spatial safety a hardware property.
- 10 Ownership and Borrowing as a Static Lifetime Proof How move semantics, exclusive borrows, and non-lexical lifetimes let a compiler prove that no pointer outlives its referent, and where the proof stops being able to help.