SHF: Small: Dynamic Detection of Heap-Based Bugs

识别软件中的错误仍然是一个具有挑战性但需要解决的基本问题。一项特别困难的任务是确保存储在内存中的大规模数据结构的完整性。现有的漏洞发现技术，如代码的静态分析，已经不能有效地解决这个问题，特别是对于复杂和高度动态的软件，如Web应用程序。该项目探索了一种在程序执行时动态检查数据结构的新技术。动态检查是有效和精确的，但必须高效，以避免显著降低程序执行速度。这项工作的关键思想是利用垃圾收集器进行检查，垃圾收集器已经定期访问程序中的所有数据结构。一种高效而精确的数据结构错误检测工具可以被广泛部署，以提高关键软件基础设施的可靠性。该项目包括三个具体的研究途径。第一个涉及基于静态分析和验证的现有技术，开发用于表达动态数据结构属性的声明性语言。第二部分研究在垃圾回收器的单次传递过程中可以检查的属性类。第三种方法构建在并发垃圾收集机制的基础上，允许堆检查与可用额外CPU核心上的应用程序并行进行。

Identifying bugs in software continues to be a challenging, but essential problem to solve. One particularly difficult task is ensuring the integrity of large-scale data structures stored in memory. Existing bug-finding techniques, such as static analysis of the code, have not been effective on this problem, especially for complex and highly dynamic software, such as web applications.This project explores a new technique for checking data structures dynamically as the program executes. Dynamic checking is effective and precise, but must be efficient in order to avoid significantly slowing program execution. The key idea in this work is to piggyback checking on the garbage collector, which already periodically visits all data structures in the program. An efficient and precise tool for detecting data structure errors could be widely deployed to improve the reliability of critical software infrastructure.The project consists of three specific avenues of research. The first involves developing a declarative language for expressing dynamic data structure properties, building on existing techniques from static analysis and verification. The second investigates the class of properties that can be checked during a single pass of the garbage collector. The third builds on the machinery of concurrent garbage collection, allowing heap checks to proceed concurrently with the application on available extra CPU cores.