Static Analysis for CHERI
summary
Custom Clang Static Analyzer checkers target CHERI portability problems rather than memory exploits: four CHERI-specific checkers detect capability alignment errors, piecemeal memcpy/tag-stripping, pointer→integer casts, and pointer arithmetic that breaks capability derivation. The tool integrates with CHERI-enabled Clang, runs on CheriBSD ports (about 2.5M LOC), reports fixes (several accepted), and finds alignment issues most often. The analysis flags unaligned allocations, unaligned memcpy patterns that strip tags, and conditional/pointer-equality patterns that must be rewritten.
AI-written summary · about
chapters (23)
- 0:00Static analysis for CHERI
- 0:22What is CHERI
- 1:04Memory safety with CHERI
- 2:08CHERI capabilities and checks
- 3:12Transitioning to CHERI issues
- 4:37Static analysis for CHERI compatibility
- 5:43Portability in CHERI transition
- 6:24CHERI impacts on C++
- 7:11Clang static analysis tool
- 7:34Pointer alignment checker
- 9:23Unaligned capability risks
- 10:27Unaligned pointer issues
- 11:08Capability alignment in alloc
- 12:35External void pointer handling
- 13:17Capability copy checker
- 13:40Invalid capability copying
- 14:21Pointer to int conversion risks
- 14:44Capability-compatible pointer arithmetic
- 15:29Pointer size checks
- 15:53CHERI ports evaluation
- 16:39True positive rates and limits
- 17:20Future directions
- 18:05Conclusion
related talks
23mCHERI static analysis
18mWhat’s next for memory safety?
10mCHERI in out-of-order microarchitectures
31mMemory Safety: The Pernicious Challenge
01h 33mHands-on Introduction to CHERI
23mInterpreter Memory Safety via Differential Fuzzing with a CHERI on Top
11mFast and fine-grained compartmentalisation in CHERI
20mMaking CHERI Accessible