The FailSafe C to Java translator Yuhki Kamijima

The Fail-Safe C to Java translator Yuhki Kamijima (Tohoku Univ. )

Background u The programming language C does not guarantee memory safety Ø This is the cause of memory attacks ex. buffer overflow attacks l Attackers can obtain root privilege and operate freely We want to execute C programs safely! 2

Background u How Ø can we achieve memory safety? Point : Java is memory safe We use Java to guarantee memory safety 3

Goal u Source to source, C to Java translation with memory safety and ANSI conformance Save a lot of work spent on rewriting programs Ø Java rejects dangerous programs Ø Prevent memory bugs and attacks 4

Summary u We propose one way of translating C to Java Well-defined operations → simulate by using objects Ø Unsafe (= undefined) operations → raise an exception Ø Pointer operations l Represent pointers and memory blocks as Java objects l Simulate pointer operations by using these objects Casts l Use access methods to access memory blocks Enables access by different types 5

Outline u. C to Java translation by using Java objects Representation of pointer operations Ø Examples of translation Ø u Class details Fat pointer, block Ø Access methods Ø Fat integer Ø u Implementation of the translator u Experiments and considerations u Related work u Conclusion and future work 6

Representation of pointer operations u. C : A pointer points to a memory block Java : The object representing a pointer refers to an object representing a memory block C pointer Java memory objects 7

Java classes u Pointer Ø : Fat. Pointer Fields : base, offset Fat. Pointer base offset u 1 word memory block : Fat. Block Field : contents Ø Method : access methods Ø Fat. Block access methods contents 8

Examples of translation : declaration int *p = NULL ; int a[3] ; Fat. Block p = new Fat. Block(1) ; Fat. Block a = new Fat. Block(3) ; access p methods u Regard access a methods variables as one element arrays 9

Address operation p = &a[1] ; generate a new pointer which points to offset 4 of a p. write. Fat(0*4, new Fat. Pointer(a, 1*4)) ; base 4 access read. Fat p methods write. Fat … virtual offset 0 a offset access methods 0 4 8 10

Address operation p = &a[1] ; write the pointer on offset 0 of p p. write. Fat(0*4, new Fat. Pointer(a, 1*4)) ; access method for 1 word write base access read. Fat p methods write. Fat … virtual offset 0 4 a offset access methods 0 4 8 11

Addition of pointer and integer p + 1; read the pointer contained at offset 0 of p i = p. read. Fat(0*4) ; new Fat. Pointer(i. base, i. offset+1*4) ; 1 word read i access read. Fat p methods write. Fat … virtual offset 0 4 base 4 a offset access methods 0 4 8 12

Addition of pointer and integer p + 1; make a new pointer which points to offset 8 of a i = p. read. Fat(0*4) ; new Fat. Pointer(i. base, i. offset+1*4) ; base 8 access read. Fat p methods write. Fat … virtual offset 0 4 a offset access methods 0 4 8 13

Cast create a new pointer which points to offset 4 of a *(char *)(&a[1]) ; i = new Fat. Pointer(a, 1*4) ; i. base. read. Byte(i. offset) ; i 4 access read. Fat read. Byte a methods write. Fat…write. Byte virtual offset 0 0 x 12345678 4 8 14

Cast read 1 byte of data from the location i points to *(char *)(&a[1]) ; i = new Fat. Pointer(a, 1*4) ; i. base. read. Byte(i. offset) ; 1 byte read i 4 0 x 12 offset 4 access read. Fat read. Byte a methods write. Fat…write. Byte virtual offset 0 0 x 12345678 4 8 15

Outline u. C to Java translation by using Java objects Representation of pointer operations Ø Examples of translation Ø u Class details Fat pointer, block Ø Access methods Ø Fat integer Ø u Implementation of the translator u Experiments and considerations u Related work u Conclusion and future work 16

Pointer operation u How to simulate a pointer which points to the middle of a memory block? Ø References in Java cannot point to the middle of an object C → Use fat pointers Java × 17

Fat Pointer [Austin et al. 94] [Oiwa et al. 01] et al. u Represent a pointer as two words base : always points to the front of a memory block Ø offset : contains an integer meaning the distance from base to the address pointed to by the pointer Ø base offset means 8 byte distance 8 the location we want to point to offset 0 4 8 12 16 20 24 28 32 18

Fat. Pointer class u Simulate fat pointers in Java base : refers to a Block object Ø offset : contains an integer Ø base offset 8 Fat. Pointer Block access methods virtual offset 0 contents 4 8 12 16 20 24 28 32 19

Block abstract class u Simulate memory blocks contents : contains an array of data objects Ø access methods : deal with memory accesses Ø u Has concrete subclasses Block (abstract) access contents methods Fat. Block access methods : Fat. Pointer object Byte. Block access methods : Byte object (1 byte of data) ・・・ 20

Access methods u Memory accesses are implemented using access methods Ø Block class has several methods for reading and writing read. Fat : 1 word read write. Fat : 1 word write read. Byte : 1 byte read write. Short : 2 byte write … Ø Enables memory accesses by different types access read. Fat read. Byte read. Short write. Byte write. Short methods write. Fat … contents 21

Fat Integer [Oiwa et al. 01] u Represent integers by two words Pointers are also integers in C, generally expressed with 1 word Ø We represent integers by objects Ø u Fat. Int class base : always null Ø offset : contains integer Ø base offset null 5 Fat. Int 22

Fat class u Common Ø parent class of Fat. Pointer and Fat. Int Fat. Block contents contains Fat objects Fat (abstract) base offset Fat. Pointer Fat. Int base offset Fat. Block access methods Fat. Pointer or Fat. Int 23

Outline u. C to Java translation by using Java objects Representation of pointer operations Ø Examples of translation Ø u Class details Fat pointer, block Ø Access methods Ø Fat integer Ø u Implementation of the translator u Experiments and considerations u Related work u Conclusion and future work 24

Implementation of the translator u Translator implemented in Objective Caml CIL [Necula et al. 02] C source code lexer C abstract syntax tree parser translator Java abstract syntax tree code generator implemente d this part prettyprinter Joust [Cooper] Java source code 25

Experiments u Benchmark programs taken from The Computer Language Shootout u Values in the graph means overheads Fail-Safe C to Java user time / C user time Ø Handwritten Java user time / C user time Ø u Environments 2. 80 GHz Intel Pentium 4 CPU, 2 GB memory Ø Linux 2. 6 Ø gcc ： version 4. 0. 0 with –O 2 option Ø javac, java ： Sun JDK version 1. 5. 0 with –O option Ø 26

Experiments 27

Consideration u All pointers, integers and memory blocks are translated to objects Ø Lots of object creations and method calls u Reduce these by optimizations Translate variables to Fat. Block only if they are pointed to by a pointer Ø Translate integers to Fat. Int only if they cannot be distinguished from pointers Ø Eliminate redundant calls to the same access method Ø 28

Outline u. C to Java translation by using Java objects Representation of pointer operations Ø Examples of translation Ø u Class details Fat pointer, block Ø Access methods Ø Fat integer Ø u Implementation of the translator u Experiments and considerations u Related work u Conclusion and future work 29

Related work : C to Java translators u Jazillian [Jazillian, Inc. ] Aims at readability and maintainability Ø Assumes user intervention of generated code Ø u Ephedra [Martin et al. 01] Does not support cast of pointers between different types Ø Does not support memory access via pointers of different types Ø l Our translator Aims at 100% ANSI conformance (and more) and memory safety Supports memory access via cast pointers by using access methods 30

Related work : Safe C runtime systems u CCured [Necula et al. 02] Dynamically checks unsafe operations Ø Reduces overheads by static analysis (to 3 - 87 %) Ø Does not aim at 100% ANSI conformance Ø u Fail-Safe C [Oiwa et al. 01] Ø l Based on the same ideas of fat pointers and fat intergers Both compile C to native code If these compilers have a bug, unsafe codes are executed l Our translator translates C to Java source code Ø Provided that Java is safe, unsafe codes are rejected (even if our translator has a bug) We clarify the essence of Fail-Safe C 31

Conclusion and future work u We Ø propose translation from C to Java Simulate pointers, integers and memory blocks with Java objects u Future work Support all ANSI C and more Ø Optimizations Ø 32