Reference1
Proving statically that a general C program (for example) never dereferences a freed pointer (the “dangling pointer” problem) is undecidable.
Region-based memory management, however, has been used to guaranttee the safety of pointer-based accesses to region data without garbage collection, but with limitations: 1) manual effort to convert program to use regions; 2) many solutions disallow explicit deallocation.
Automatic regions inference algorithms have been developed to solve limitation completely or partially, such as in ML, or Cyclone. But these languages disallow explicit deallocation.
In this work, we use our fully automatic region inference algorithm called Automatic Pool Allocation that works for C with explict malloc and free. The transformation solves both the limitations above.
Unfortunately, allowing individual object deallocation means that the transformation does not ensure memory safety.
T2. Cast to a pointer from other types are disallowed; certaion pointer to pointer casts of two compatible targets are allowed (2002+);
T3. Union can only contain types that can be cast to each other (as in 2002).
Rules for pointer safety:
If you could revise
the fundmental principles of
computer system design
to improve security...
... what would you change?