Exploits against heap memory errors continue to be a major concern. Although many defenses have been proposed, heap data are not protected from attacks that exploit memory errors systematically. Research defenses focus on complete coverage of heap objects, often giving up on comprehensive memory safety protection and/or incurring high costs in performance overhead and memory usage. In this paper, we propose a solution for heap memory safety enforcement that aims to provide comprehensive protection from memory errors efficiently by protecting those heap objects whose accesses are provably safe from memory errors. Specifically, we present the Uriah system that statically validates spatial and type memory safety for heap objects, isolating compliant objects on a safe heap that enforces temporal type safety to prevent attacks on memory reuse. Using Uriah, 71.9% of heap allocation sites can be shown to produce objects (73% of allocations are found safe) that satisfy spatial and type safety, which are then isolated using Uriah's heap allocator from memory accesses via unsafe heap objects. Uriah only incurs 2.9% overhead and only uses 9.3% more memory on SPEC CPU2006 (C/C++) benchmarks, showing that many heap objects can be protected from all classes of memory errors efficiently.

翻译：针对堆内存错误的漏洞利用仍然是主要的安全隐患。尽管已有大量防御机制被提出，但堆数据仍无法免受系统性利用内存错误的攻击。现有研究型防御方案侧重于覆盖所有堆对象，往往以放弃全面的内存安全保护为代价，且/或导致高昂的性能开销与内存占用。本文提出一种堆内存安全实施方案，旨在通过保护那些经证明可免于内存错误的堆对象，高效实现全面的内存错误防护。具体而言，我们设计的Uriah系统能够静态验证堆对象的空间与类型内存安全性，将符合安全要求的对象隔离至一个强制时间类型安全的"安全堆"中，从而防止针对内存重用的攻击。利用Uriah，71.9%的堆分配站点可被证明生成满足空间与类型安全性的对象（73%的分配被判定安全），这些对象通过Uriah的堆分配器与经由不安全堆对象进行的内存访问相隔离。在SPEC CPU2006（C/C++基准测试）上，Uriah仅产生2.9%的性能开销且仅增加9.3%的内存使用，这表明大量堆对象可被高效地防护所有类别的内存错误。