The downgrading semantics of memory safety

2025-07-15

AI Summary

This paper addresses the lack of principled semantic definitions for memory safety. We introduce *progressive allocator independence*, a novel concept grounded in information-flow control, to formally characterize the noninterference between memory allocators and program execution. For the first time, memory exhaustion and pointer-to-integer conversion are modeled as declassification operations, enabling precise analysis of canonical unsafe behaviors—including out-of-bounds accesses and dangling pointers—within a unified semantic framework. Based on a flat memory model and standard malloc/free primitives, we develop the first rigorously defined formal theory of allocator independence. Our approach significantly enhances the expressiveness and precision of memory safety semantics, providing a foundational basis for the design and verification of memory-safe programming languages.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Conceptual Inference and Reasoning
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Security and Privacy: Data transparency and provenance
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

Memory safety is traditionally characterized in terms of bad things that cannot happen, an approach that is often criticized as unprincipled. Prior work suggest a connection between memory safety and noninterference, but no satisfactory semantic notion of memory safety is currently known. This work proposes a notion of gradual allocator independence that accurately captures many allocator-specific aspects of memory safety. We consider a low-level language with access to an allocator that provides malloc and free primitives in a flat memory model. Pointers are just integers, and as such it is trivial to write memory-unsafe programs. The basic intuition of gradual allocator independence is that of noninterference, namely that allocators must not influence program execution. This intuition is refined in two important ways to account for the allocators running out-of-memory and for programs to have pointer-to-integer casts. The key insight of the definition is to treat these extensions as forms of downgrading and give them satisfactory technical treatment using the state-of-the-art information flow machinery.

Problem

• Defining semantic notion of memory safety
• Connecting memory safety with noninterference
• Handling allocator influence on program execution

Innovation

• Gradual allocator independence captures memory safety
• Noninterference principle refined for allocator influence
• Downgrading treated with information flow machinery