1. BY SAM COLLIE
UNIVERSITY OF ALABAMA
AT BIRMINGHAM
IPROGRESS LAB
Instrumentation of Unsafe C
Functions to Safe Functions Using
the RTC Tool
Slide: 1 of 21

2. Outline
 Background on RTC and ROSE
 My Extension
 Comparison to other tools
 Current Drawbacks and Future Goals
Slide: 2 of 21

3. What is RTC?
 RTC is a runtime checking tool for the C
programming language co-developed at
UAB.
 It’s built on the ROSE compiler to read in
source code, make changes to it, and output
new code.
Slide: 3 of 21

4. Background
 C is the second most popular programming
language (IEEE Spectrum ranking 2015).
 Thanks to manual management of memory via
pointer, C programs can achieve a staggering level
of efficiency.
Slide: 4 of 21

5. Safe Languages
Slide: 5 of 21
 Java:
int[] numbers = new int[10];
numbers[11] = 5;
Exception in thread "main"
java.lang.IndexOutOfBoundsException: Index: 11,
Size: 10 at
java.util.ArrayList.rangeCheck(ArrayList.java:604)

6. Unsafe Languages
Slide: of 21
 C Language:
int numbers[10];
numbers[11] = 5;
 What will C do?
 Undefined Behaviour.

7. RTC: Instrumentation
ROSE Parser
Preprocessing
Instrumentation
ROSE Unparser
RTC
Source Code Instrumented
Source Code
Slide: 6 of 21

8. Pointer Metadata
Slide: 7 of 21
 Records Lower and Upper bounds of allocation.
 Records scope in which pointer is valid.
 Records whether the memory allocated to the
pointer has been freed.

9. Checks Made by RTC
Slide: 8 of 21
 Uses the metadata to make spatial and temporal
checks
 Spatial: No index out of bounds access
 Temporal: No leaving a valid scope with freeing
memory allocated to pointer

10. RTC vs. Other Tools
Slide: 9 of 21

11. Metadata Stack
 Globally accessible stack
 Handles passing pointers from one function to
another
 Only handles situation where both functions can
access same global scope.
Slide: 10 of 21

12. Passing Pointers
Slide: 11 of 21
Push Metadata
Pass Pointer
Pop Metadata
Perform Checks

13. Specific Aims
 To instrument function calls to C
Standard Library functions that are
unsafe.
By changing the function calls to call a
library whose source code will be visible to
RTC during the instrumentation process.
Slide: 12 of 21

14. Take the following code:
BEFORE
int main(){ memcpy(dest, src, size); }
************************************************
AFTER
int main(){ rtcMemCpy(dest,src,size); }
rtcMemCpy(void* dest, const void* src, size_t size){
// rtcMemCpy source code
}
************************************************
Slide: 14 of 21

15. Implementation
 Takes place before RTC instrumentation
 Function names are instrumented, and function
definitions are added.
 Finally, RTC itself is run to insert the checks into
added function definitions
Slide: 15 of 21

16. How is this helpful?
 There are several commonly used standard
library functions that operate on pointers.
 Some of these functions don't guarantee
spatial and temporal safety within the
function (unsafe).
Slide: 16 of 21

17. Memcpy
Slide: 17 of 21
void* memcpy(void* dest, const void* src, size_t size){
char *dp = dest;
const char *sp = src;
while (size--)
*dp++ = *sp++; //unsafe access
return dest;
}

18. Comparison to Other Techniques
 ManagedC (Grimmer et al., 2015)
 All or nothing instrumentation
 Valgrind
 Can make checks due to using binaries, has a much
larger footprint
 Address Sanitizer (Serebryany et al, 2012)
 Handles “some” functions but excludes third party
libraries
Slide: 18 of 21

19. Current Drawbacks
 Some standard library functions are dependent on
other standard library functions that are also unsafe.
 Can’t keep up to date pointer information when
pointers are passed to functions not in our provided
library.
Slide: 19 of 21

20. Future Goals
 Fix interdependency problems
 Optimize
 Add more functions to the safe library
 Allow easy addition of functions to safe library by
users
Slide: 20 of 21