Bounds Checking Projects

This page describes work in progress to add fine-grained bounds checking to GCC's C and C++ front-ends. Interested parties are invited to port to Objective C as well. Please contact Greg McGary, greg@mcgary.org if you wish to assist with development or testing.

Contents


Overview

Bounded Pointers are easy to understand. GCC augments every pointer datum with two additional pointers that hold the low bound and high bound of the object to which the pointer is seated. Prior to dereference, GCC generates code to test whether the pointer's value lies within the bounds, and if bounds are violated, to generate a machine exception.

Many find the notion of changing the size of a fundamental data type alarming, but for well-formed higher-level C code that uses accurate function prototypes and avoids abusing pointer/integer casts, this is seldom a problem in practice. Even low-level code can use bounded pointers with some extra care.

Project Status (updated 2000-08-11)

Goals

Non-Goals

Bounded pointers do not detect the following errors in memory-usage:

Memory checks are done by Purify or Checker (Refer to GCC's -fcheck-memory-usage option). The checks provided by bounded pointers and the memory-usage checkers complement each other nicely without overlap.

Maybe Goals

Other Links in the Toolchain

Building GCC and glibc for Bounded Pointers

If you wish to help with development and/or testing, you must first build a baseline. In the examples below, the shell variables ``$..._dir'' represent the directory names of your toplevel gcc, glibc, ld and gdb trees. The shell variables ``$..._repo'' hold the names of the GCC and glibc CVS repositories. The values of these repository variables will depend on whether you have write access or have readonly access through pserver/anoncvs mode. I'll assume you know enough about CVS and about configuring and building GNU packages to adapt the procedure below to fit your environment.

  1. Checkout, build and install GCC

    $ mkdir -p $gcc_dir/BUILD
    $ cd $gcc_dir
    $ cvs -d $gcc_repo co -rbounded-pointers-ss-20000730 -d src gcc
    $ cd BUILD
    $ ../src/configure --prefix=$gcc_dir --enable-languages=c
    $ make bootstrap
    $ make install
    

    For convenience, you might wish to install a symlink called ``gcc-bp'' in one of your bin directories that refers to $gcc_dir/bin/gcc.

  2. Checkout, build and install glibc

    $ mkdir -p $glibc_dir/BUILD
    $ cd $glibc_dir
    $ cvs -d $glibc_repo co -d src libc
    $ cd BUILD
    $ env CC=$gcc_dir/bin/gcc ../src/configure --prefix=$glibc_dir \
    	--enable-bounded --disable-profile --disable-shared
    $ make
    $ make install
    

    I recommend ``--disable-profile'' and ``--disable-shared'' in order to shorten build time since you won't need these targets.

  3. Obtain, patch, build and install GNU ld

    I won't give detailed instructions here, because there's nothing out of the ordinary. Download a modern binutils release, or get the code from CVS.

    You will need a small patch to GNU ld so that it will synthesize ``foo.high_bound'' symbols for common & bss symbols. (Get the ld patch from here) The patch is relative to binutils-2.10, but will work on binutils-2.9 as well.

  4. Obtain, patch, build and install gdb

    I won't give detailed instructions here, because there's nothing out of the ordinary. Download a modern gdb release, or get the code from CVS.

    You will need a small patch to gdb so that it won't crash starting up on a BP-mode program. Get the gdb patch from here. The patch is relative to gdb-5.0, but will work on gdb-4.18 as well, if you supply the `-l' option to patch to make it more lenient about whitespace differences.

Testing with Bounded Pointers

Now that you have the essentials for working with bounded pointers, here are some suggestions for testing. I present them in order of increasing difficulty. You will be testing three things: (1) correctness of BP-mode code generated by GCC, the correctness of the C library's handling of BPs, and (3) correctness of the code under test. If you wish to focus on debugging the BP implementation in GCC and the GNU C library, then you should test using mature infrastructure packages that have been around for many years. If you test on new code, you're more likely to find bugs in the application, which is of course what the BP feature is designed for, so you are most surely welcome to do that!

Packages Tested Using Bounded Pointers (updated 2000-08-09)

Below is a list of results for packages tested with bounds checking. Unless otherwise noted, tests were done by me (Greg).

Known Bugs

Here is a list of bugs known to exist for bounded pointer mode in GCC and in the GNU C library, as well as some commonly found problems in applications:

How to Port to a new CPU

Most of the bounded pointers implementation is machine independent, both in GCC and in the C library. These are the machine-dependent parts:

GCC Implementation Details

Sorry, nothing yet... This stuff properly belongs in either the GCC manual or the GCC ``Internal Representation'' document.


Greg McGary, greg@mcgary.org