Re: Stopping buffer-overflow security exploits using page protect

From: Crispin Cowan (crispin@wirex.com)
Date: Mon Jul 31 2000 - 11:32:13 EST


Florian Weimer wrote:

> Crispin Cowan <crispin@wirex.com> writes:
>
> > > What is the level of performance hit, using bounds-checking?
> >
> > Highly variable. The best example of a full bounds-checking C compiler
> > is the GCC enhancement here http://web.inter.nl.net/hcc/Haj.Ten.Brugge/
> >
> > Based on the compiler's documentation, it imposes between 3X and 30X
> > slowdowns, depending on the application.
>
> If you use a language which includes a proper array type, the overhead
> isn't that huge. (With full checking, the Ada version of Dhrystone
> 2.1 runs approximately at 60% of the speed of the C version. This
> includes full range checking on integer variables.)

That's true, but we're talking about C code. I've heard 3rd hand that Java
can check array bounds at around 30% overhead. But because C obscures the
relationship between pointers and array references, you have to work *much*
harder to determine if a given array reference is within bounds.

You can see this in the Compaq C compiler for Alpha, which provides "bounds
checking" of a sort: it only checks explicit array references such as a[3],
and does not check pointer expressions such as *(a+3). This is problematic,
because all arrays passed as arguments to other functions are passed as
pointers, so the Compaq bounds checking only works when the array is in the
same function that is accessing it.

The bounds checking GCC compiler doesn't have this restriction, but instead
has to solve the problem of associating a storage range with each pointer
expression. To do that, it has to do a LOT of work for every array reference
to look up the allowed storage range.

Crispin

--
Crispin Cowan, Chief Scientist, WireX Communications, Inc. http://wirex.com
Free Hardened Linux Distribution:                          http://immunix.org

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Mon Jul 31 2000 - 21:00:34 EST