SGCheck: an experimental stack and global array overrun detector
• Coverage: Stack and global checking is fragile. If a shared object does not have debug information attached, then
SGCheck will not be able to determine the bounds of any stack or global arrays defined within that shared object,
and so will not be able to check accesses to them.
This is true even when those arrays are accessed from some
other shared object which was compiled with debug info.
At the moment SGCheck accepts objects lacking debuginfo without comment.
This is dangerous as it causes
SGCheck to silently skip stack and global checking for such objects. It would be better to print a warning in such
circumstances.
• Coverage: SGCheck does not check whether the the areas read or written by system calls do overrun stack or global
arrays. This would be easy to add.
• Platforms: the stack/global checks won’t work properly on PowerPC, ARM or S390X platforms, only on X86 and
AMD64 targets. That’s because the stack and global checking requires tracking function calls and exits reliably,
and there’s no obvious way to do it on ABIs that use a link register for function returns.
• Robustness: related to the previous point.
Function call/exit tracking for X86 and AMD64 is believed to work
properly even in the presence of longjmps within the same stack (although this has not been tested). However, code
which switches stacks is likely to cause breakage/chaos.
11.6. Still To Do: User-visible Functionality
• Extend system call checking to work on stack and global arrays.
• Print a warning if a shared object does not have debug info attached, or if, for whatever reason, debug info could
not be found, or read.
• Add some heuristic filtering that removes obvious false positives.
This would be easy to do.
For example, an
access transition from a heap to a stack object almost certainly isn’t a bug and so should not be reported to the user.
11.7. Still To Do: Implementation Tidying
Items marked CRITICAL are considered important for correctness: non-fixage of them is liable to lead to crashes or
assertion failures in real use.
• sg_main.c: Redesign and reimplement the basic checking algorithm. It could be done much faster than it is -- the
current implementation isn’t very good.
• sg_main.c: Improve the performance of the stack / global checks by doing some up-front filtering to ignore
references in areas which "obviously" can’t be stack or globals.
This will require using information that
m_aspacemgr knows about the address space layout.
• sg_main.c: fix compute_II_hash to make it a bit more sensible for ppc32/64 targets (except that sg_ doesn’t work
on ppc32/64 targets, so this is a bit academic at the moment).
157
