Spatial safety violations are the root cause of many security attacks and unexpected behavior of applications. Existing techniques to enforce spatial safety work broadly at either object or pointer granularity. Object-based approaches tend to incur high CPU overheads, whereas pointer-based approaches incur both high CPU and memory overheads. SGXBounds, an object-based approach, is so far the most efficient technique that provides complete out-of-bounds protection for objects. However, a major drawback of this approach is that it can't support address space larger than 32-bit. In this paper, we present CGuard, a tool that provides object-bounds protection for C applications with comparable overheads to SGXBounds without restricting the application address space. CGuard stores the bounds information just before the base address of an object and encodes the relative offset of the base address in the spare bits of the virtual address available in x86_64 architecture. For an object that can't fit in the spare bits, CGuard uses a custom memory layout that enables it to find the base address of the object in just one memory access. Our study revealed spatial safety violations in the gcc and x264 benchmarks from the SPEC CPU2017 benchmark suite and the string_match benchmark from the Phoenix benchmark suite. The execution time overheads for the SPEC CPU2017 and Phoenix benchmark suites were 42% and 26% respectively, whereas the reduction in the throughput for the Apache webserver when the CPUs were fully saturated was 30%. These results indicate that CGuard can be highly effective while maintaining a reasonable degree of efficiency.

翻译：空间安全违规是许多安全攻击及应用程序意外行为的根本原因。现有强制空间安全的技术大致分为对象粒度和指针粒度两类。基于对象的方法通常会产生较高的CPU开销，而基于指针的方法则同时面临较高的CPU和内存开销。SGXBounds作为一种基于对象的方案，是目前为对象提供完全越界保护的最高效技术。然而，该方法的主要缺陷在于无法支持超过32位的地址空间。本文提出CGuard这一工具，可为C语言应用程序提供对象边界保护，其开销与SGXBounds相当，且不限制应用程序的地址空间。CGuard将边界信息存储在对象基地址之前的位置，并利用x86_64架构虚拟地址的空闲位编码基地址的相对偏移量。对于无法容纳于空闲位的对象，CGuard采用自定义内存布局，仅需一次内存访问即可定位对象基地址。我们的研究在SPEC CPU2017基准套件的gcc和x264基准测试以及Phoenix基准套件的string_match基准测试中发现了空间安全违规现象。SPEC CPU2017和Phoenix基准套件的执行时间开销分别为42%和26%，而在CPU完全饱和状态下，Apache Web服务器的吞吐量降低30%。这些结果表明，CGuard在保持较高效率的同时，具有出色的有效性。