Accelerating Type Confusion Detection by Identifying Harmless Type Castings
Xiaokang Fan, Sifan Long, Chun Huang, Canqun Yang, F. Y. Li · 2023
C++ allows reinterpretation of memory objects via type casting, which facilitates easier manipulation of class fields and virtual methods inside the class hierarchy. However, misinterpretation of memory objects, which is called type confusion, can result in illegal access of class fields or methods. Type confusion accounts for many security vulnerabilities for programs written in C++. Previous type confusion detection techniques report a type confusion bug when an object of a parent class is casted to a child class. However, a downcast is safe as long as no illegal fields or methods are accessed. This paper presents Harmless Type Casting Detection (htade), which identifies safe downcast instructions and removes redundant runtime verifications before them by analyzing the type and access information of casted objects. We evaluated htade against 11 SPEC CPU 2006/2017 C++ programs. Compared with LLVM-CFI, htade can reduce the runtime performance overhead by 58.98% on average.