Venerable Variadic Vulnerabilities Vanquished
summary
A compiler-based sanitizer called HexVASAN records call-site metadata and verifies variadic argument types at runtime via an LLVM compiler pass plus a runtime library, catching mismatches (including format-string abuses and indirect-call hijacks) by aborting or logging errors. Implementation handles multiple va_list instances, separate floating-point vs integer register conventions, and aggregate (struct/union) argument unpacking. Evaluation on SPEC2006 and Firefox shows negligible overhead (reported 0.45% average) and practical detection of real variadic bugs; code is open source.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:49Defense Mechanisms
- 4:40Software Analysis
- 9:19Approach
- 9:39Highlevel design
- 11:16Hex Pearson
- 12:19Challenges
- 14:41Evaluation
- 15:15Pseudo
- 16:34Performance Overhead
- 17:03Omni GBP Benchmark
- 17:38Firefox Benchmark
- 18:56Conclusion
related talks
01h 26mVulnerable C++
27mHaskell Library for Safer Virtual Machine Introspection (Experience Report)
01h 30mDangerous Optimizations in C and C++ Programming Languages
59mBeyond Sanitizers...
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
36mA Hybrid Alias Analysis Framework and Its Application to Protecting the Linux Kernel
26mSyscall Me by Your Name: Sandboxing Wasm Programs
01h 02mSanitize your C++ code