メモリ安全なC言語実装「Fil-C」について紹介

$ wget https://github.com/pizlonator/fil-c/releases/download/v0.675/filc-0.675-linux-x86_64.tar.xz
$ tar -xvf filc-0.675-linux-x86_64.tar.xz
$ cd filc-0.675-linux-x86_64
$ ./setup.sh
$ ./build/bin/clang --version
Fil-C 0.675 clang version 20.1.8 (git@github.com:pizlonator/llvm-project-deluge.git e16f10094cc38a6444e3d5d9cc4914120b380e5b)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/mix64/filc-0.675-linux-x86_64/build/bin
Build config: +assertions

#include <stdio.h>
#include <string.h>

void vulnerable_function() {
    char buffer[10];
    // 10バイトのバッファに、32バイトを書き込む
    // 標準Cではスタック破壊が発生する
    strncpy(buffer, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 32);

    printf("Buffer: %s\n", buffer);
}

int main() {
    printf("Starting overflow test...\n");
    vulnerable_function();
    printf("Finished normally (This should not happen).\n");
    return 0;
}

$ gcc -O0 overflow_test.c -o overflow_test
overflow_test.c: In function ‘vulnerable_function’:
overflow_test.c:8:5: warning: ‘__builtin_memcpy’ writing 32 bytes into a region of size 10 overflows the destination [-Wstringop-overflow=]
    8 |     strncpy(buffer, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 32);
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
overflow_test.c:5:10: note: destination object ‘buffer’ of size 10
    5 |     char buffer[10];
      |          ^~~~~~

$ ./overflow_test
Starting overflow test...
Buffer: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Segmentation fault

$ ./build/bin/clang -O0 overflow_test.c -o overflow_test
overflow_test.c:8:5: warning: 'strncpy' size argument is too large; destination buffer has size 10, but size argument is 32 [-Wfortify-source]
    8 |     strncpy(buffer, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 32);
      |     ^
1 warning generated.

$ ./overflow_test
Starting overflow test...
filc safety error: cannot write pointer with ptr >= upper.
    pointer: 0x7fe3b3f84340,0x7fe3b3f84330,0x7fe3b3f84340
    expected 1 writable bytes.
semantic origin:
    src/string/stpncpy.c:12:17: __stpncpy
check scheduled at:
    src/string/stpncpy.c:12:18: __stpncpy
    src/string/strncpy.c:5:2: strncpy
    <somewhere>: vulnerable_function
    <somewhere>: main
    src/env/__libc_start_main.c:79:7: __libc_start_main
    <runtime>: start_program
[2908] filc panic: thwarted a futile attempt to violate memory safety.
Trace/breakpoint trap

#include <stdlib.h>
#include <stdio.h>

int main() {
    int *data = (int*)malloc(sizeof(int));
    *data = 42;
    printf("Allocated: %d\n", *data);

    free(data);
    printf("Freed data.\n");

    // 解放済みのメモリにアクセス
    // 標準Cでは「42」が表示されたり、クラッシュしたり、不定となる
    printf("Accessing after free: %d\n", *data);
    
    return 0;
}

$ gcc -O0 uaf_test.c -o uaf_test
$ ./uaf_test
Allocated: 42
Freed data.
Accessing after free: 1519600330
$ ./uaf_test
Allocated: 42
Freed data.
Accessing after free: 1509833197

$ ./build/bin/clang -O0 uaf_test.c -o uaf_test
$ ./uaf_test
Allocated: 42
Freed data.
filc safety error: cannot read pointer to free object.
    pointer: 0x7f51bad84270,0x7f51bad84270,0x7f51bad84270,free
    expected 4 bytes.
semantic origin:
    <somewhere>: main
check scheduled at:
    <somewhere>: main
    src/env/__libc_start_main.c:79:7: __libc_start_main
    <runtime>: start_program
[4739] filc panic: thwarted a futile attempt to violate memory safety.
Trace/breakpoint trap

#include <stdio.h>
#include <stdint.h>

int main() {
    int secret = 12345;
    int *ptr = &secret;
    
    // ポインタを整数に変換
    uintptr_t addr = (uintptr_t)ptr;
    printf("Address: 0x%lx\n", addr);
    
    // 整数からポインタへキャスト
    int *forged_ptr = (int*)addr;
    
    // 標準Cではアクセス可能
    // Fil-Cではここでトラップするはず
    printf("Forged access: %d\n", *forged_ptr);
    
    return 0;
}

$ gcc -O0 forge_test.c -o forge_test
$ ./forge_test
Address: 0x7ffdeaa5be34
Forged access: 12345

$ ./build/bin/clang -O0 forge_test.c -o forge_test
$ ./forge_test
Address: 0x7f77aac84270
filc safety error: cannot read pointer with null object.
    pointer: 0x7f77aac84270,<null>
    expected 4 bytes.
semantic origin:
    <somewhere>: main
check scheduled at:
    <somewhere>: main
    src/env/__libc_start_main.c:79:7: __libc_start_main
    <runtime>: start_program
[6805] filc panic: thwarted a futile attempt to violate memory safety.
Trace/breakpoint trap

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

#define ITERATIONS 100000000

struct Node {
    int value;
    struct Node *next;
};

int main() {
    printf("Starting benchmark with %d iterations...\n", ITERATIONS);
    clock_t start = clock();

    struct Node *head = NULL;

    // 1. 大量の割り当てとリンク (Allocation & Linking)
    for (int i = 0; i < ITERATIONS; i++) {
        struct Node *new_node = (struct Node*)malloc(sizeof(struct Node));
        if (!new_node) {
            perror("malloc");
            return 1;
        }
        new_node->value = i;
        new_node->next = head;
        head = new_node;
    }

    // 2. トラバース (Traversal - Read access check)
    long long sum = 0;
    struct Node *current = head;
    while (current!= NULL) {
        sum += current->value;
        current = current->next;
    }

    // 3. 解放 (Free - GC logic)
    current = head;
    while (current!= NULL) {
        struct Node *temp = current;
        current = current->next;
        free(temp);
    }

    clock_t end = clock();
    double time_spent = (double)(end - start) / CLOCKS_PER_SEC;

    printf("Sum: %lld\n", sum);
    printf("Time: %f seconds\n", time_spent);

    return 0;
}

$ gcc -O0 perf_test.c -o perf_test
$ ./perf_test
Starting benchmark with 100000000 iterations...
Sum: 4999999950000000
Time: 2.820630 seconds

$ gcc -O2 perf_test.c -o perf_test
$ ./perf_test
Starting benchmark with 100000000 iterations...
Sum: 4999999950000000
Time: 2.690448 seconds

$ ./build/bin/clang -O0 perf_test.c -o perf_test
$ ./perf_test
Starting benchmark with 100000000 iterations...
Sum: 4999999950000000
Time: 8.555717 seconds

$ ./build/bin/clang -O2 perf_test.c -o perf_test
$ ./perf_test
Starting benchmark with 100000000 iterations...
Sum: 4999999950000000
Time: 6.629729 seconds