Poster: Targeted Therapy for Program Bugs

Program bugs widely exist and render software faulty and vulnerable. Existing systems for surviving software failures and attacks are mostly like chemotherapy, a cancer therapy that causes severe adverse side effects because of imprecise treatments. We propose Software Targeted Therapy, a new model for surviving software failures and attacks due to program bugs, that characterizes cancer-cells-like program elements concisely at diagnosis and then applies treatments to them precisely at software execution with minimal overhead. As a case study, we apply Software Targeted Therapy to addressing heap buffer overflows, one of the most dangerous software vulnerabilities, and implement HeapTherapy. To our knowledge, HeapTherapy is the first efficient design that prevents memory corruption caused by buffer overflows without disrupting software execution (e.g., bounds checking can only prevent corruption). The slowdown averages 6% on SPEC CPU2006 when HeapTherapy treats up to 10 heap buffer overflow bugs simultaneously.