1. Taint-based Dynamic Analysis
CoC Research Day - 9/25/2009
Designed at Apple in California;
assembled at GeorgiaTech

2. Dynamic Tainting Overview
C
A
B Z

3. Dynamic Tainting Overview
1 Assign
taint marks
C
A
B Z

4. Dynamic Tainting Overview
1 Assign
taint marks
C
A
B
312
Z

5. Dynamic Tainting Overview
1 Assign
taint marks
2 Propagate
taint marks
C
A
B
312
Z

6. Dynamic Tainting Overview
1 Assign
taint marks
2 Propagate
taint marks
C
A
B
312
Z

7. Dynamic Tainting Overview
1 Assign
taint marks
3 Check
taint marks
2 Propagate
taint marks
C
A
B
312
Z

8. Dynamic Tainting Overview
1 Assign
taint marks
3 Check
taint marks
2 Propagate
taint marks
C
A
B
312
Z
C
A
B
312
Z
3

9. Dynamic Tainting Applications
Attack detection / prevention
Information policy enforcement
Testing
Memory errors
Data lifetime

10. Dynamic Tainting Applications
Attack detection / prevention
Prevent stack smashing, SQL injection, buffer overruns, etc.
Attack detection / prevention
Information policy enforcement
Testing
Memory errors
Data lifetime

11. Dynamic Tainting Applications
Information policy enforcement
ensure classified information does not leave the system
Attack detection / prevention
Information policy enforcement
Testing
Memory errors
Data lifetime

12. Dynamic Tainting Applications
Testing
Coverage metrics, test data generation heuristic, etc.
✔/✘
Attack detection / prevention
Information policy enforcement
Testing
Memory errors
Data lifetime

13. Dynamic Tainting Applications
Attack detection / prevention
Information policy enforcement
Testing
Data lifetime
track how long sensitive data remains in an application
Memory errors
Data lifetime

14. Dynamic Tainting Applications
Attack detection / prevention
Information policy enforcement
Testing
Memory errors
Detect illegal memory access, leak detection, etc.
Memory errors
Data lifetime

15. Dynamic Tainting Applications
Attack detection / prevention
Information policy enforcement
Testing
Memory errors
Detect illegal memory access, leak detection, etc.leak detection
Memory errors
Data lifetime

16. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy

17. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy

18. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy; fixing them is not

19. Discover where the last pointer to un-freed memory is lost
Leak Detection Overview

20. Assign
taint marks
Propagate
taint marks
Check
taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero and
memory has not been freed.
1 1
1
Discover where the last pointer to un-freed memory is lost
Leak Detection Overview

21. Assign
taint marks
Propagate
taint marks
Check
taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero and
memory has not been freed.
1 1
1
Discover where the last pointer to un-freed memory is lost
Leak Detection Overview
# of pointers
tainted with
this color

22. Assign
taint marks
Propagate
taint marks
Check
taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero and
memory has not been freed.
1 1
1
Discover where the last pointer to un-freed memory is lost
Leak Detection Overview

23. Assign
taint marks
Propagate
taint marks
Check
taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero and
memory has not been freed.
2
1 1
1
1 2
2
2
1
1 2 2
Discover where the last pointer to un-freed memory is lost
Leak Detection Overview

24. Assign
taint marks
Propagate
taint marks
Check
taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero and
memory has not been freed.
2
1 1
1
1 2
2
2
1
1 2 2
In general propagation follows standard pointer arithmetic rules
Discover where the last pointer to un-freed memory is lost
Leak Detection Overview

25. Assign
taint marks
Propagate
taint marks
Check
taint marks
ptr1 = malloc(...) ➔ ptr1
ptr2 = calloc(...) ➔ ptr2
ptr3 = ptr1 ➔ ptr3 , ptr1
ptr1 = NULL ➔ ptr1 , ptr3
ptr4 = ptr2 + 1 ➔ ptr4 , ptr2
Report error if taint mark’s count is zero and
memory has not been freed.
2
3
1 1
1
1 2
2
2
1
1 2 2
In general propagation follows standard pointer arithmetic rules
Discover where the last pointer to un-freed memory is lost
Leak Detection Overview

26. addhash(char hname[]) {
35. int i;
36. HASHPTR hptr;
37. unsigned int hsum = 0;
38. for(i = 0 ; i < strlen(hname) ; i++) {
39. sum += (unsigned int) hname[i];
40. }
41. hsum %= 3001;
42. if((hptr = hashtab[hsum]) == (HASHPTR) NULL) {
43. hptr = hashtab[hsum] = (HASHPTR) malloc(sizeof(HASHBOX));
44. hptr->hnext = (HASHPTR) NULL;
45. hptr->hnum = ++netctr;
46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
47. sprintf(hptr->hname , "%s" , hname);
48. return(1);
49. } else {
! ...
67. }
}
Detecting leaks is easy

27. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}
Detecting leaks is easy

28. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
Detecting leaks is easy; fixing them is, too
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}

29. 46. hptr->hname = (char *) malloc((strlen(hname) + 1) *
! ! ! ! ! ! ! ! ! ! sizeof(char));
Detecting leaks is easy; fixing them is, too
delHtab() {
15. int i;
16. HASHPTR hptr , zapptr;
17. for(i = 0; i < 3001; i++) {
18. hptr = hashtab[i];
19. if(hptr != (HASHPTR) NULL) {
20. zapptr = hptr ;
21. while(hptr->hnext != (HASHPTR) NULL) {
22.! ! hptr = hptr->hnext;
23.! ! free(zapptr);
24.! ! zapptr = hptr ;
25.! ! }
26.! ! free(hptr);
27.! }
28. }!
29. free(hashtab);
30. return;
}
free(hptr->hname)

30. Leakpoint implementation

31. Leakpoint implementation
Pointer to memory area 0x1C93AC0 (16 bytes)
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)

32. Leakpoint implementation
Pointer to memory area 0x1C93AC0 (16 bytes)
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)

33. Leakpoint implementation
Pointer to memory area 0x1C93AC0 (16 bytes)
allocated:
at malloc
by addhash (hash.c:50)
by parser (parser.c:210)
by readcell (parser.c:34)
by main (main.c:98)
was leaked:
at free
by delHtab (hash.c:28)
by grdcell(grdcell.c:354)
by main (main.c:227)

34. Evaluation

35. Evaluation
Transmission

36. Evaluation
Transmission
Locations identified by Leakpoint correspond to
where the leaks were fixed by developers.

37. Evaluation
Transmission
Also found thousands of leaks in the
SPEC INT benchmarks
Locations identified by Leakpoint correspond to
where the leaks were fixed by developers.

38. static void processCompletedTasks(tr_web *web) {
...
task->done_func(web->session, ..., task->done_func_user_data);
...
evbuffer_free(task->response);
tr_free(task->url);
tr_free(task);
...
}
static void invokeRequest(void * vreq) {
...
hash = tr_new0(uint8_t, SHA_DIGEST_LENGTH);
memcpy(hash, req->torrent_hash, SHA_DIGEST_LENGTH);
tr_webRun(req->session, req->url, req->done_func, hash);
...
}
static void onStoppedResponse(tr_session *session, ..., void *torrent_hash) {
dbgmsg(NULL, "got a response ... message");
// tr_free(torrent_hash);
onReqDone(session);
}

39. Overhead
Powerful but expensive
50 - 100x overheads
are common
• Execution time is completely automated
• Developers have to think less

40. Questions?