Description:

Jonathan Aldrich, Carnegie Mellon University
Professor and Director, Master of Software Engineering programs

This is a two part talk: 3/4 on a research project on safer Rust and 1/4 an information session for students who may be interested in a master's degree in software engineering.  Regarding the research, Rust is increasingly being used as a replacement for memory unsafe languages in large-scale, security-critical applications. However, these new Rust components will need to interoperate with existing C and C++ code, and these languages have different notions of undefined behavior that conflict with Rust’s aliasing rules. Few tools can detect when unsafe operations introduce aliasing bugs, and none have the combination of compatibility and performance that will be necessary for industrial use. We are working to fill this tooling gap with BorrowSanitizer: an LLVM-based instrumentation tool for finding violations of Rust’s latest Tree Borrows aliasing model in multilanguage applications. A research prototype version of our tool has already found dozens of bugs, including some in prominent Rust libraries. Our approach combines techniques used by prior sanitizer implementations to propagate provenance metadata through shadow memory, with the goal of being compatible with techniques for fuzzing and property-based testing.