McDermott Will & Emery LLP
Detecting and handling vtable pointer corruption
A system and method is disclosed for providing security in virtual function calling. During a build process a program code is analyzed to identify one or more call sites used to facilitate a call to a subroutine associated with a declared object type. One or more trusted vtable pointers to a respective subroutine is determined, and the program is configured, via the build process, to detect, at an execution time, an initiation of a virtual call at a call site, verify whether a vtable pointer used in connection with the call site is associated with at least one of the trusted vtable pointers, and, if verified, facilitate the virtual call using the call site. If the vtable pointer cannot be verified then the virtual call is aborted.
Google Inc.
G G
G06F G06F
inventional inventional
Geoffrey Roeder Sriraman Lawrence Alan Caroline Xinliang David Kenneth Úlfar Cary Allen
Pike Tallam Crowl Tice Li Buchanan Erlingsson Coutant