Mediaspace scheduled maintenance: Aug 25, 2026 07:00 - 12:00 AM. During this time, videos will be temporarily unavailable. Check status updates.

Lecture

Software security - Memory safety

In course

COM-301: Computer security and privacy

This is an introductory course to computer security and privacy. Its goal is to provide students with means to reason about security and privacy problems, and provide them with tools to confront them. ...

Description

This lecture covers the basics of software security, focusing on memory safety, including temporal errors and spatial errors. It discusses the importance of software security, the consequences of memory safety issues, and mitigation strategies against code execution attacks such as uncontrolled format string vulnerabilities.

Instructors (2)

Edouard Bugnion

Edouard Bugnion joined EPFL in 2012, where his focus is on datacenter systems. His areas of interest include operating systems, datacenter infrastructure (systems and networking), and computer architecture. Before joining EPFL, Edouard spent 18 years in the US, where he studied at Stanford and co-founded two startups: VMware and Nuova Systems (acquired by Cisco). At VMware from 1998 until 2005, he played many roles including CTO. At Nuova/Cisco from 2005 until 2011, he helped build the core engineering team and became the VP/CTO of Ciscos Server, Access, and Virtualization Technology Group, a group that brought to market Ciscos Unified Computing System (UCS) platform for virtualized datacenters. Prof. Bugnion is a Fellow of the ACM. Together with his colleagues, he received the ACM Software System Award for VMware 1.0 in 2009. His paper Disco: Running Commodity Operating Systems on Scalable Multiprocessors" received a Best Paper Award at SOSP '97 and was entered into the ACM SIGOPS Hall of Fame Award in 2008. At EPFL, he received the OSDI 2014 Best Paper Award for his work on the IX dataplane operating system

Carmela González Troncoso

Official source

Ontological neighbourhood

Theoretical computer science

Programming language theory: High-level programming languages

Related concepts (32)

Printf

The printf family of functions in the C programming language are a set of functions that take a format string as input among a variable sized list of other values and produce as output a string that corresponds to the format specifier and given input values. The string is written in a simple template language: characters are usually copied literally into the function's output, but format specifiers, which start with a character, indicate the location and method to translate a piece of data (such as a number) to characters.

Low-level programming language

A low-level programming language is a programming language that provides little or no abstraction from a computer's instruction set architecture—commands or functions in the language map that are structurally similar to processor's instructions. Generally, this refers to either machine code or assembly language. Because of the low (hence the word) abstraction between the language and machine language, low-level languages are sometimes described as being "close to the hardware".

Buffer overflow

In programming and information security, a buffer overflow or buffer overrun is an anomaly whereby a program writes data to a buffer beyond the buffer's allocated memory, overwriting adjacent memory locations. Buffers are areas of memory set aside to hold data, often while moving it from one section of a program to another, or between programs. Buffer overflows can often be triggered by malformed inputs; if one assumes all inputs will be smaller than a certain size and the buffer is created to be that size, then an anomalous transaction that produces more data could cause it to write past the end of the buffer.

Memory safety

Memory safety is the state of being protected from various software bugs and security vulnerabilities when dealing with memory access, such as buffer overflows and dangling pointers. For example, Java is said to be memory-safe because its runtime error detection checks array bounds and pointer dereferences. In contrast, C and C++ allow arbitrary pointer arithmetic with pointers implemented as direct memory addresses with no provision for bounds checking, and thus are potentially memory-unsafe.

High-level programming language

In computer science, a high-level programming language is a programming language with strong abstraction from the details of the computer. In contrast to low-level programming languages, it may use natural language elements, be easier to use, or may automate (or even hide entirely) significant areas of computing systems (e.g. memory management), making the process of developing a program simpler and more understandable than when using a lower-level language. The amount of abstraction provided defines how "high-level" a programming language is.

Related lectures (30)

Programming Language Security

Explores programming language security, covering type safety, memory safety, threat safety, Rust's ownership model, sandboxing, and compartmentalization.

Virtual Machines: Memory Management and Control Flow

Covers the architecture of virtual machines, focusing on memory management, control flow, and the CEK machine's semantics.

Challenges in IoT Era MOOC: IoT Systems and Industrial Applications with Design Thinking

Covers IoT security challenges, cyber-physical attacks, and global attack surfaces.

Taming Null References

Explores the challenges of null references in programming languages and proposes solutions to mitigate their drawbacks while ensuring compatibility with existing codebases.

Introduction to Types and Inductive Relations