 |
libmemalloc 0.0.0-alpha
The Magic of Memory Transmutation
|
|
libmemalloc 0.0.0-alpha
The Magic of Memory Transmutation
|
Use this document to build the threat model and check for applicable protection controls. Start at boundaries, find the index control and follow the requirements to the test catalog.
Expands the threat model for syscalls, stack/TLS, join, atomics, hostile corpus, exhaustion and instrumentation gaps. Destructive tests are isolated and do not acquire valid C semantics just by running on a child.
Evidence: Product specification. Allocator tests, product portability, Rust, Fuzzing and stress were not performed in this delivery. Repository checks validate documents and automation fixtures only; no product approval is inherited from these checks or from other documents.
Product: libmemalloc. Status: proposed implementation, not an implemented library or evidence of better performance than another allocator.
The local C standard, module architecture, and pitfall guide govern C development. Product constraints in these specifications refine the permitted implementation. Apply C and platform semantics first, then approved product constraints and local policy. Conflicts require an explicit decision; a policy exception cannot make undefined behavior defined.
MUST and MUST NOT express requirements; MAY grants conditional permission. A control's classification does not by itself measure failure severity. Keep stable control, requirement, invariant, and test identifiers when editing. References explain a technique; they do not prove this composition or its results. BASE does not mean implemented, and EXPERIMENTAL does not establish novelty. The H-01 through H-14 hypotheses remain experiments, not results.
Public names use LMA_lowerCamelCase, private names use lma_lowerCamelCase, owned types use lma_*_t, and structure tags use the Lma prefix and UpperCamelCase. Use Allman compound statements, eight-column indentation, and 80-column C lines. The result variable is ret, declarations occur at the permitted scope entry, and normal return follows function_output. Explicit null pointers follow the local typed-null rule. Public C headers do not add explicit extern or embedded C++ bridges. API descriptions abbreviate local LMA_E* error codes; adapters translate foreign codes without depending on foreign errno numbers.
The local simple-branch rule in CSTYLE-022 and the grouping rules in CSTYLE-279 and CSTYLE-280 apply to these examples. One-line simple if bodies omit braces; loops and compound branch bodies retain them.
The companion schemas, migration records, and validation reports mentioned by the original package are not present here. They are not current execution evidence. The CIreference states the actual check coverage. Product capabilities remain unqualified until their required evidence exists; missing or conflicting evidence blocks the capability.
This document owns the threat model, protection requirements and mitigation limitations. Algorithms of allocation/GC remain defined in their SDDs; the detection campaign and toolchain configuration are consumed by testing/compilation.
| Proposed profile | Always present controls | Additional controls and cost |
|---|---|---|
| Performance | Valid arithmetic, ownership, correct publications, OOM, contracted quotas | It can maintain intrusive links; it does not promise complete detection of corruption. |
| Hardened | All correction requirements | Slot status, extra validation, metadata isolation/guards/quarantine according to capacity; measured cost. |
| Diagnosis | Entry and correctness contracts | Integration with detectors and enhanced visibility controlled; it is not release benchmark. |
| Sensitive | explicitly qualified profile | Delete, copy protection and restricted logs; do not automatically cover swap, dumps or a compromised host. |
An option that costs RMW in the hardened profile cannot be presented as manual path without RMW. Lack of mandatory mechanism rejects the profile without silent downgrade.
Implementation of the manual core and arenas · Optional collector implementation and integration with runtimes · Tests, verification, experiments and evidence · Compilation, modules, ABI, PGO and delivery
Input checks must precede mutation. Build trust and hostile-test containment have separate boundaries from the allocator's runtime contract.
flowchart LR
Caller[Caller-controlled sizes / alignment / handles] --> Validate[Validate contract and ownership]
Validate -->|Rejected| Error[Defined error; preserve required state]
Validate -->|Accepted| Budget[Check resource budget]
Budget --> Mutation[Transactional state change]
Mutation --> Publish[Publish complete valid state]
Tools[Build tools / profiles / dependencies] --> Provenance[Verify input provenance]
Provenance --> Product[Qualified product artifact]
Hostile[Hostile traces and destructive fixtures] --> Sandbox[Isolated test process]
Supervisor[Independent resource supervisor] --> Sandbox
Sandbox --> Findings[Bounded findings and raw evidence]
The controls below define proposed mechanisms. The example appendix provides implementation context without establishing a stable ABI or product qualification.
M0: OPTIONAL. G0: OPTIONAL.
Phase: P1. Nature: BASE. Status: PROPOSED.
Negative tests distributed in this package use rejected inputs and defined models; they do not perform invalid UAF, double free or C-date race to then expect the behavior to be specified. Detector tests that deliberately exceed ISO C are tool isolated fixtures, with declared instrumentation contract and without being presented as compliant C examples.
StarMalloc: A Formally Verified, Concurrent, Performant, and Security-Oriented Memory Allocator: Separate security mechanisms from formally verified properties.
snmalloc: Message passing based allocator: Remote return must remain correct under protective modes.
ANSI/ISO C Specification Language (ACSL): Explicit contracts for validation and invariants.
Offer selected performance, protection and diagnostic profiles in domain creation. Quarantine, additional validation, poisoning and external metadata may have different costs. Structural profile changes will not be made by reinterpreting live objects. Guard pages will be selective, not presumed by object.
List links within released blocks continue to be metadata accessible to improper writing in the profile that uses them. Link encoding does not equal cryptographic security or complete detection of use-after-free. Sanitizer integrations need to describe logical allocation, release and internal areas used by the allocator itself; its implementation will be validated by positive and negative tests.
LMA-SEC-002 defines the threat model and instrumentation limits. A negative test only counts as evidence of detection if it effectively triggers the expected detector. Unprotected regions for intrusive links and interactions with other allocators need specific cases.
LMA-SEC-001-R01. MUST measure overhead of each profile and compare equivalent settings.
LMA-SEC-001-R02. MUST avoid recursive allocation and external callbacks within critical diagnostic locks.
LMA-SEC-001-R03. MUST distinguish detected error, probabilistic mitigation and demonstrated property.
LMA-SEC-001-I01. Protection mechanisms do not allow the use of invalid pointers.
LMA-SEC-001-I02. Changing telemetry does not modify the contracted representation of existing objects.
No profile turns arbitrary C into memory-safe language. Instrumented tests do not replace proof of concurrent protocol.
LMA-TEST-CASE-0109, LMA-TEST-CASE-0110, LMA-TEST-CASE-0111. All cases remain planned for the product.
M0: OPTIONAL. G0: OPTIONAL.
Phase: P1. Nature: BASE. Status: PROPOSED.
CWE/OWASP references are taxonomy and threat orientation. They do not constitute certification, nor do they impose HTTP authentication on a without network access library. The range of each mitigation and each detector needs to be declared by profile.
StarMalloc: A Formally Verified, Concurrent, Performant, and Security-Oriented Memory Allocator · Scudo Hardened Allocator · AddressSanitizer public interface: asan_interface.h · SeMalloc: Semantics-Informed Memory Allocator
Scudo Hardened Allocator provides an example of hardening; AddressSanitizer public interface: asan_interface.h exposes poisoning instrumentation; StarMalloc: A Formally Verified, Concurrent, Performant, and Security-Oriented Memory Allocator separates verified properties from the rest of the system. SeMalloc: Semantics-Informed Memory Allocator explores semantics of allocation for security. None of them automatically makes libmemalloc memory-safe.
Set the opponent of each profile: accidental boundary error, UAF, double-free, misinformed size, adjacent corruption or arbitrary writing. Declaring which regions the opponent can reach and what secret/entropy remains available. Guard pages and metadata isolation cover different threats of link code/decode. Platform capabilities may reinforce a profile but are not hidden requirement of portable core.
A domain allocation or validation bitmap can detect some invalid operations. Faced with corruption detected in a structure that controls write addresses, the hardened mode prefers closed failure and non-recursive diagnosis; do not continue using untrusted links. Error calls have restricted effects and do not receive unnecessary addresses that increase exposure.
When using ASan or equivalent, describing the logical limits of each object and the state after free. The allocator itself may need to access bytes of intrusive links in released object. Unpoisoning these bytes for maintenance creates a window/region that should not be sold as covered by complete detection. Alternatives: structure outside payload, internal access instrumented under specific protocol or complementary detector; each alternative requires testing.
Quarantine changes time of reuse, retention and probability of observation; it is not proof of absence of UAF. Separation by site/type also has cost and does not replace ownership. Compare hardening with equivalent profiles of competitors and include deliberately hostile loads, as well as overhead in valid cases.
LMA-SEC-002-R01. MUST publish covered, uncovered threats and environmental assumptions for each profile.
LMA-SEC-002-R02. MUST define the reaction to corruption before continuing a destructive operation.
LMA-SEC-002-R03. MUST validate detector with positive and negative tests, including bytes used for intrusive links.
LMA-SEC-002-R04. MUST account for memory and quarantine latency, guards, bitmaps and semantic segregation.
LMA-SEC-002-I01. Probabilistic mitigation is never labeled as universal detection or functional proof.
LMA-SEC-002-I02. The diagnosis does not introduce recursive allocation or use already invalidated metadata as authority.
A process with arbitrary writing can compromise more than the allocator. This SDD does not assign cryptographic security to link encoding nor inherits StarMalloc evidence. A configuration that eliminates test failure by chance does not count as validated detector.
LMA-TEST-CASE-0175, LMA-TEST-CASE-0176, LMA-TEST-CASE-0177. All cases remain planned for the product.
The following contracts are normative for the proposed implementation. Product qualification remains pending.
Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P0.
Related standards and scenarios: CMOD-082 · CMOD-085 · CMOD-086 · CSTYLE-059.
The OWASP orientation of three modeling provides a method of identifying assets and boundaries. CWE classifies weaknesses, does not certify the product. In this document, OWASP is the reference interpreted from “OSAP” in the request.
The availability assessment also considers CWE-401: keeping reusable caches within the contract is not by itself losing memory ownership; the oracle needs to distinguish these situations.
Assets: integrity of regions/identities, sensitive payload confidentiality, budget limited availability, ownership correction, release artifacts and evidence. Inputs: sizes/alignments, application content, type descriptors, ports/configuration, profile data, backend events and tool results.
Threat A: Remote caller influences sizes and sequences by an application that uses the library. The allocator needs to reject overflow and respect quotas, but does not authenticate the remote user. Threat B: Application bug provides invalid pointer or writes after release. Hardened profile tries to detect declared classes before interpreting metadata; does not convert arbitrary C into memory-safe. Threat C: Limited payload corruption/links in the profile hardware model. External metadata mechanisms, status and validation reduce exploitation without ensuring arbitrary writing protection throughout the process. Threat D: Attacker controls PR, dependency, PGO file or tool path in the pipeline.
Native ports are code capabilities: a function injected into the same process can execute arbitrary instructions with process permissions. Binding validates form, lifetime, and contract; does not make a malicious provider safe. A requirement of isolation between tenants/provers requires additional process, hardware, or effective protection, not only callbacks.
They stay out of the direct scope: Web authentication, SQL, XSS, CSRF, TLS of service and business authorization, because the library does not implement these services. These controls belong to the integrator when they exist. Do not apply OWASP Top 10 as a decorative list of compliance to a heap.
Each threat has a scenario, proprietary component, preconditions, preventive control/detector, test and residual risk. Every new backend, moving domain, plugin, ISA or profile opens revision of this model. Libmemalloc does not assume that the compromised host/compiler is a reliable base and simultaneously promises to resist it without an external trust root.
LMA-SEC-003-R01. The product MUST publish assets, boundaries, capabilities of the opponent and exclusions by profile.
LMA-SEC-003-R02. Each protection requirement MUST declare whether it prevents, detects or only hinders a failure class.
LMA-SEC-003-R03. Ports and modules in the same process MUST NOT be described as sandbox or authenticated boundary.
LMA-SEC-003-R04. CWE and OWASP MUST be used with concrete applicability, without claiming universal certification or coverage.
LMA-SEC-003-I01. The scope of the security claim does not exceed the published threat model.
LMA-SEC-003-I02. The composition does not give a callback greater confidence than that granted to its provider.
LMA-TEST-CASE-0237, LMA-TEST-CASE-0238.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P0.
Related standards and scenarios: CSTYLE-059 · CSTYLE-060 · CSTYLE-079 · CSTYLE-102 · CSTYLE-125 · CMOD-090.
CWE-190 and CWE-131 connect incorrect arithmetic calculation to smaller buffers than necessary. CWE-125 describes reading out of bounds. The controls below are specific LMA obligations. CWE-122 it deals with overflow in heap buffers; the allocator must limit its own writings, but does not automatically intercept all application writing through a raw pointer.
Numerical inputs are checked before multiplying count×size, adding header/padding, rounding alignment, forming address or converting to narrow index. For an interval, validate offset ≤ capacity and length ≤ capacity−offset, instead of testing offset+length after possible wrap. For multiplication, treat zero and validate against SIZE_MAX before product.
Alignment needs to be supported by the backend, compatible with the representation and served for every block. A bit mask only replaces split/rounding when the power property of two has been validated. Convert external descriptors in a byte-safe way; structure C, enum or bit-field is not portable serialized format. The source memory has qualified alignment and effective type.
The output is not read before your contract requires initial value. Rejection preserves the status before counting, connecting us or publishing root. A NULL check does not demonstrate arbitrary pointer ability/lifetime. Scanner offsets are validated against type size, field width, alignment and amount of fields; an enum tag does not validate the domain itself.
Tainted sizes have recoverable failure, not a wrapper that terminates the entire process by simple ENOMEM. Real corruption of critical structures is another situation, with declared fail-stop policy; do not confuse legitimate pressure with corruption. Do not create assume, unreachable or branch hint that treats an input not validated as impossible.
LMA-SEC-004-R01. Every input derivative calculation MUST be verified before performing the potentially invalid operation.
LMA-SEC-004-R02. Type/preset descriptors MUST be validated before indexing, converting or changing state.
LMA-SEC-004-R03. Untrusted boundary size/quota failures MUST be recoverable and preserve existing data.
LMA-SEC-004-R04. Compiler assumptions MUST NOT replace necessary validations in runtime.
LMA-SEC-004-I01. A large entry cannot become a small order successful by wrap.
LMA-SEC-004-I02. No derived address is formed before knowing the valid limits of its origin.
LMA-TEST-CASE-0239, LMA-TEST-CASE-0240.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: OPTIONAL. G0: OPTIONAL.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P1.
Related standards and scenarios: CSTYLE-082 · CSTYLE-118 · CSTYLE-174 · CPIT-002 · CPIT-003 · CPIT-007.
CWE-416, CWE-415 and the page Using freed memory from OWASP The proposal reduces opportunities for reuse/corruption, but does not promise to detect any old aliases.
In the hardened profile, separating status metadata from the slot from the payload previously controlled by the application. The LIVE→REMOTE_PENDING or LIVE→FREE/QUARANTINED transition has its own synchronization when it can be observed by other participants. Only the winner of an accepted return can change accounting. This check adds RMW/cost and is not assigned to the minimum path without RMW of the performance profile.
Before using the block as a node, locate the region by the ownership map, validate domain, slot limit, alignment, generation and state according to the profile capacity. Do not interpret bytes preceding an arbitrary pointer as header to find out if the pointer belongs to the heap. Already corrupted metadata require detection/fail-stop before chaining a destination.
A quarantine postpones reuse by budget of bytes and inputs; under pressure it can reduce time coverage, but never release live object. The duration is no guarantee that all invalid aliases have disappeared. After reuse, a raw pointer with the same address can be indistinguishable from a current pointer without additional information; document this limitation.
GC validates handle origin and generation, but a root-free copied handle may become obsolete. BorrowEnd terminates protection and all subsequent use of the address violates contract. The core does not accept free GC slot manual; arena does not accept individual free as if it were manual heat.
The compliant tests use model identities/offsets and validation APIs that reject input before dangerous accesses. Fixtures that deliberately use expired pointers to test ASan are detector-specific and are not C-reference executables defined.
LMA-SEC-005-R01. The hardened profile MUST specify slot status and single return transition at the corresponding cost.
LMA-SEC-005-R02. Validation MUST precede intrusive interpretation of payload as a metadata.
LMA-SEC-005-R03. Quarantine MUST be bounded; publish its temporal coverage and limitations.
LMA-SEC-005-R04. The library MUST NOT promise to detect all use of raw pointer after reuse of the same address.
LMA-SEC-005-R05. Manual, arena and managed objects MUST maintain separate families and authorities.
LMA-SEC-005-I01. An accepted return reduces accounting only once.
LMA-SEC-005-I02. Quarantine does not alter the validity of a live object.
LMA-TEST-CASE-0241, LMA-TEST-CASE-0242, LMA-TEST-CASE-0243.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: OPTIONAL. G0: OPTIONAL.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P1.
Related standards and scenarios: CMOD-096 · CSTYLE-156 · CPIT-021 · CPIT-078.
Scudo exemplifies integrity and mitigation mechanisms; StarMalloc Its mechanisms and evidence are not guarantees of the proposed implementation here.
The performance baseline can store links in free slots. Therefore, it will not be described as “totally external metadata”. The hardened profile prefers state and external links or validated indexes; independent metadata also have cost and can be targets if the opponent already has arbitrary writing across space.
When consuming an index/link, validating region, limit, alignment and state before forming a usable address. A link scheme encoded with cookie makes it difficult for certain corruptions, but it is not cryptographic authentication. Do not invent encryption, MAC or PRNG for the heap. The specification needs to state which bytes influence the verification and what happens when the value is invalid; hash without secret does not resist by definition the intentional rewrite of both fields.
Guard pages are selective and depend on granularity/capacity of the backend. They do not detect any small excess that remains on the same page. Redzones and canaries are only examined at declared points. Poisoning can detect writing in some modes; it does not prevent arbitrary access in uninstrumented build.
Metadata protection does not depend on reading addresses that have already been unmapped. Descriptors kept stable in M0 simplify lifetime, but their storage needs quota. Tags/generations do not make a reference to the valid descriptor after it is destroyed. Any early recovery has its own reader model.
When detecting irreversible corruption, do not try to “follow the next node” or continue sweep to save memory. Issue limited diagnosis according to context and execute qualified fail-stop policy, or return corruption only when there has been no mutation and the contract allows to preserve integrity.
LMA-SEC-006-R01. Each profile MUST list intrusive and external metadata without claiming protection beyond real representation.
LMA-SEC-006-R02. Decoding/validation of links MUST occur before any dereference of destination.
LMA-SEC-006-R03. Canaries, guards and cookies MUST declare checkpoints, coverage and limitations.
LMA-SEC-006-R04. Corruption detected MUST NOT be used as a basis for continuing alteration of structures without proven recovery protocol.
LMA-SEC-006-I01. No invalid link detected is followed before the failure decision.
LMA-SEC-006-I02. Metadata life is protected regardless of its generation/cookie.
LMA-TEST-CASE-0244, LMA-TEST-CASE-0245, LMA-TEST-CASE-0246.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P0.
Related standards and scenarios: CSTYLE-113 · CSTYLE-154 · CMOD-118 · CPIT-115.
CWE-770 Here the risk includes not only payload, but metadata, queues, pins, roots, finalizers and maintenance work.
The resource limit needs to include metadata and reservations for committed operations, not only bytes requested by the user. Many small orders can exhaust descriptors; many profile sites can exhaust cardinality; many borrows can block recovery; many weak/finalizable references can produce extra work. Each class has quota and iteration/retry limit.
Use exact admission tickets for a ceiling, and estimates only for soft policy. Return credit only when the corresponding feature has been released. Fair drainage policy prevents small entries from being forgotten indefinitely on arrivals with better score, on the stated progress assumptions. It does not guarantee deadline when the owner is suspended.
OOM in tracing never allows partial sweep. Lack of destination never allows to discard survivors. A pressed system can return ENOMEM even having unrecoverable retained memory. Report causes: live roots, pins, owner making no progress, partially live region, quarantine and historical metadata. Do not try to solve them all by repeated collections.
The network/application layer may need throttling per user; the LMA instance knows only the domains/quotas provided by the integrator. If tenants share an instance without independent quotas, the allocator does not automatically create availability isolation.
LMA-SEC-007-R01. Quotas MUST cover metadata, queues, root/tickets, relevant profiles and reservations beyond payload.
LMA-SEC-007-R02. Attempts to recover and work by call MUST be limited and observable.
LMA-SEC-007-R03. Pressure failure MUST preserve live objects and distinguish resource unavailable from corruption.
LMA-SEC-007-R04. The lack of isolation between tenants who share instance MUST be explicit in integration.
LMA-SEC-007-I01. Estimates do not grant accurate credit or eliminate life protections.
LMA-SEC-007-I02. Safe retention is not converted into unsafe recovery to meet a roof.
LMA-TEST-CASE-0247, LMA-TEST-CASE-0248.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: OPTIONAL. G0: OPTIONAL.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P1.
Related standards and scenarios: CSTYLE-067 · CMOD-091 · CMOD-096 · CPIT-097 · CPIT-098.
CWE-244 addresses waste in the heap, CWE-14 the removal of cleaning by the compiler and CWE-532 A common malloc is not, on its own, secret storage.
Sensitive domain is opt-in with specific contract. The integrator declares which intervals need cleaning and your life. The operation uses a primitive non-eliminable erasure provided by the qualified backend; in C23, the availability/semantic of memset_explicit should be checked in runtime, not only presumed by language flag. In compatible profile, use approved adaptive with explicit warranty, never a common memset advertised as safe.
Before copying by realloc or moving sensitive object, consider temporary duplicates: origins and destinations need the same policy and error discards are also cleaned. Store keys/cookies from the allocator itself in a state that is not serialized in snapshots. Erasing an interval does not eliminate copies in caches, registers, swaps, core dumps or files; each additional protection belongs to a platform capability and threat model.
Production logs do not include payload, secrets or full addresses by default. Use event identifier, domain, size range, state and cause categorized. Diagnostic profiles with addresses require controlled access/retention. Do not treat stable address hash as universal anonymization.
The diagnostic port gets typed and limited registration, run out of locks when possible. Under corruption/OOM, use preallocated path or discard diagnostic with counter; do not recur in the allocator to explain that the allocator failed. External text is not format string, file name or executable code.
LMA-SEC-008-R01. Sensitive domain MUST qualify a primitive erasure and treat temporary/rollback copies.
LMA-SEC-008-R02. The product MUST NOT promise absence of waste outside the controlled ranges/capacity.
LMA-SEC-008-R03. Logs and profiles MUST delete payload and sensitive addresses by default and set retention/access.
LMA-SEC-008-R04. Diagnosis MUST be limited and not depend on recursive allocation in the path of failure.
LMA-SEC-008-I01. Delete does not occur before the end of legitimate use.
LMA-SEC-008-I02. A logging failure does not change the security decision or release a protected object.
LMA-TEST-CASE-0249, LMA-TEST-CASE-0250.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: OPTIONAL. G0: OPTIONAL.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P1.
Related standards and scenarios: CSTYLE-059 · CSTYLE-114 · CMOD-083 · CMOD-096 · CPIT-100.
CWE-338 The LMA contract distinguishes layout randomization from a cryptographic warranty and requires qualified source when protection cookies depend on unpredictability.
The entropy port belongs to the security owner; declares requested amount, partial return, failure and lock. The integrator cannot replace for time, address, counter or rand without formally changing capacity. Determinism is allowed in the test profile for reproduction, but not in release that announces unpredictability.
If there is no required entropy, creation of the ordered profile fails or maintains only an explicitly different configuration that has not been requested as mandatory. Do not fall silently into the performance profile. Restart after fork/cloning is only supported when the process and the life of the allocator have protocol; post-fork multithread baseline remains restricted.
Structural options are immutable while objects live. Environment variables do not disable guards/validators of an instance whose configuration came from reliable policy. A preset parser rejects relevant unknown keys, negative limits, overflow, incompatible dependencies and flags that point to arbitrary function/library.
Register profile identification, effective capabilities and boot failures without revealing secrets/cookies. A “secure=true” parameter is not evidence; tests check which mechanisms were executed.
LMA-SEC-009-R01. Entropy for safety mitigation MUST come from qualified port and have partial failures/returns treated.
LMA-SEC-009-R02. The deterministic test build MUST be distinguishable from release and prohibited in the unpredictability profile.
LMA-SEC-009-R03. Required security feature failure MUST NOT cause silent downgrade.
LMA-SEC-009-R04. Structural options MUST be fixed before live objects and load verifiable profile identification.
LMA-SEC-009-I01. An announced profile does not silently omit a mandatory mechanism.
LMA-SEC-009-I02. Protection secrets do not appear in the configuration log.
LMA-TEST-CASE-0251, LMA-TEST-CASE-0252.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P0.
Related standards and scenarios: CMOD-084 · CMOD-086 · CMOD-103 · CMOD-106 · CSTYLE-115.
The guidelines of CI/CD and OWASP supply chain they support the protection of inputs and artifacts. CWE-829 and CWE-427 help to classify inclusion/untrusted paths.
Compiler, linker, generators, profile tools, instrumentation libraries, scripts and caches influence the product. Register hashes/versions, origin and permissions. Untrusted PR does not get publishing credentials or write in the cache/profile used as a reliable release entry. An artifact signature only attests to the signed material within the trust chain; does not prove no bug.
PGO/MemProf profiles and presets are compilation entries that deserve provenance. The profile parser performs in isolated/limited environment without signature secret. A profile file coming from external user or benchmark is not automatically promoted. The manifest connects source, toolchain, options, workload, profile and binary result. Deprecated or incompatible profile is rejected/reclassified in new campaign, not accepted after suppressing global warning.
Do not insert build flags coming from text without validation into shell commands. Use controlled tool paths/dependencies and avoid searching for paths saved by attacker. Interposition is only enabled in the application by explicit choice; do not download or load plugin into LMA_create.
Test dependencies remain outside the product. Maintaining license inventory and algorithm assignment; citing a paper does not authorize copying incompatible license code. Coil patterns are linked to the consulted commit and identified as a source of policy; the product license needs its own revised decision.
Publish checksums, build metadata, API/export list and evidence matching the commit. Removing debug symbols from distributed binary is a distribution option with separate symbols; it is not a barrier against memory exploration.
LMA-SEC-010-R01. Every build entry, including PGO profile, MUST have origin/version/hash and trusted boundary registered.
LMA-SEC-010-R02. Untrustworthy executions MUST NOT feed reliable caches, profiles, or release artifacts without a revised promotion.
LMA-SEC-010-R03. The loader/adapter MUST use controlled paths and do not introduce interposition or plugins implicitly.
LMA-SEC-010-R04. Delivery MUST maintain inventory of dependencies, licenses, exports and evidence by commit.
LMA-SEC-010-I01. The profile used in a release corresponds to the signed/identified manifest of that release.
LMA-SEC-010-I02. Delivery credentials do not enter into execution of tool controlled by unreliable source.
LMA-TEST-CASE-0253, LMA-TEST-CASE-0254, LMA-TEST-CASE-0255.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Classification: SECURITY. Obligation: design requirements. Nature: BASE. Phase: P0.
Related standards and scenarios: CMOD-093 · CMOD-102 · CMOD-113 · CSTYLE-099.
ASan, TSan and UBSan suballocation requires integrating its logical events; a large mmap alone does not describe to the detector the limits of each object.
Set a matrix by profile: logical allocation/dislocation, redzones, intrusive metadata, zeroing, quarantine, external regions and uninstrumented libraries. The detector adapter has the annotations. Removing poisoning temporarily to read a link creates a distinct window/covering that needs to be published; prefer external metadata in the profile used to check payload.
A positive test proves that valid operations do not trigger the check. A negative contract test delivers invalid sizes/offsets/IDs to a boundary that rejects them before UB. A specific detector test can perform deliberately invalid access according to its instrumented environment, but is isolated, identified, does not enter into compliant C examples and is not defined behavior proof.
The suite needs to prove that the mechanism was connected: an executable that never calls the candidate backend does not validate this backend. Instrumentation changes allocator layout, contention, and behavior; production benchmarks use final binary without undeclared collection costs. ASan+UBSan and TSan are separate campaigns; unsupported options fail to configure.
Suppressing a sanitizer region requires justification, deviation identifier, scope and alternative test. Wide suppression to make the allocator “pass” is not evidence. Finite domain tests or linters will not be labeled as complete allocator proof.
LMA-SEC-011-R01. Each detector MUST have integration and coverage declared for internal suballocations and metadata.
LMA-SEC-011-R02. The suite MUST prove activation of the mechanism/backend and distinguish defined contract rejection from tool-specific UB.
LMA-SEC-011-R03. Suppressions MUST be local, traceable and accompanied by alternative verification.
LMA-SEC-011-R04. No instrumented binary performance MUST be used as a release performance without declaring the cost.
LMA-SEC-011-I01. Absence of notice only sustains the coverage and execution effectively observed.
LMA-SEC-011-I02. A negative test presented as C as it does not perform deliberate UB.
LMA-TEST-CASE-0256, LMA-TEST-CASE-0257.
The results remain planned for the implementation of the product. Capacity is only promoted after checking these requirements in the corresponding profile; bibliographic reference or auxiliary example does not replace this evidence.
CWE describes weakness; the correspondence below is applicability analysis LMA. It does not imply that a vulnerability already exists in the product or that the control eliminates the entire class.
| Primary reference | Scenario LMA | Owner Control | Expected evidence / limit |
|---|---|---|---|
| CWE-122 | Writing beyond the limits of an allocation in the heap | LMA-SEC-006 | Validate own copies; Selective guards do not prevent all overflow of the application. |
| CWE-401 | Memory without release at the end of effective use | LMA-SEC-007 | Ownership oracle and closing; separate leak from intentionally accounted retention. |
| CWE-190 | Overflow in multiplication/sum/rounding | LMA-SEC-004 | Rejection before calculation; helpers and boundaries SIZE_MAX. |
| CWE-131 | Buffer less than requested by incorrect calculation | LMA-SEC-004 | Size/alignment, headers and padding in the oracle. |
| CWE-125 | Reading beyond object/scanner/link | LMA-SEC-004 | Limits before address, validated field description. |
| CWE-415 | Duplicate Return | LMA-SEC-005 | Single state of return; do not promise to detect every raw pointer. |
| CWE-416 | Reference after the end of life | LMA-SEC-005 | Ownership/roots/tickets, limited quarantine and detector. |
| CWE-843 | Type of region/object incompatible | LMA-SEC-006 | Domain, type and origin before interpreting. |
| CWE-457 | Fields/references not initialized | LMA-SEC-004 | Scannable publication; semantic initialization, not just memset. |
| CWE-362 | Shared accesses without protocol | LMA-SEC-005 | Locks/atomics/lifetime specified and competing model. |
| CWE-770 | Resources without limit | LMA-SEC-007 | Payload quota, metadata, roots, profiles and work. |
| CWE-244 | Sensitive residue in the heap | LMA-SEC-008 | Port of qualified deletion and processing of copies. |
| CWE-14 | Cleaning eliminated by optimizer | LMA-SEC-008 | Primitive guaranteed in the profile and inspection of the artifact. |
| CWE-532 | Log sensitive secret/address | LMA-SEC-008 | Limited DTO, no payload logs by default. |
| CWE-338 | PRNG inadequate for protection | LMA-SEC-009 | Qualified entropy source, no silent fallback. |
| CWE-829 | Untrusted source code/tool | LMA-SEC-010 | Provenance and isolation of build/credentials. |
| CWE-427 | Library/tool search in unsafe path | LMA-SEC-010 | Controlled Paths and separate loading. |
Phase: P0. Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Class: CORRECTNESS / ARCHITECTURE. Status: PROPOSAL; evidence of pending product.
Linux: clone/clone3 · Microsoft: Calling Internal APIs · Apple: syscall(2), historical file
Removing libc/pthread reduces certain dependencies, but transfers validation from ABI, TLS, waits and lifetime to the library. It is not a proof of lower effective surface or superior security. The Threat Model includes unexpected returns, permissions, sandboxes, unknown flags, unavailable syscall, corruption of thread records, and incorrect backend selection.
Each syscall has allowlist per operation and ABI, size/flag validation, return parser and retrieve budget. Runtime does not try to escape from seccomp, entitlement or host policy when it receives prohibition. Windows/Apple crus profiles do not use heuristic search for syscall numbers, patching or unqualified private calls to fake portability. OS-library bridge dependencies are an architectural alternative identified, not enabled by the strict product without approval.
Boundary tests inject faults by controlled provider and also confirm the actual artifact under sandbox. Logs hide unnecessary addresses and content; syscall arguments, strokes and dumps may contain sensitive data. Diagnose failure should not return to the corrupted heap to produce an elaborate message.
LMA-SEC-012-R01. MUST version operations/ABI allowlist and validate returns before converting them to valid resources.
LMA-SEC-012-R02. MUST NOT circumvent host policy denial as compatibility fallback.
LMA-SEC-012-R03. MUST register threat differences between crude backend, OS bridge and test provider.
LMA-SEC-012-R04. MUST maintain limited diagnostic failure and no recursion in the allocator.
LMA-SEC-012-I01. A kernel error never becomes a published pointer.
LMA-SEC-012-I02. The strict mode does not silently load an external runtime.
LMA-TEST-CASE-0385, LMA-TEST-CASE-0386, LMA-TEST-CASE-0387, LMA-TEST-CASE-0388, LMA-TEST-CASE-0389, LMA-TEST-CASE-0390, LMA-TEST-CASE-0391, LMA-TEST-CASE-0392, LMA-TEST-CASE-0393, LMA-TEST-CASE-0394, LMA-TEST-CASE-0395, LMA-TEST-CASE-0396, LMA-TEST-CASE-0503, LMA-TEST-CASE-0504, LMA-TEST-CASE-0505, LMA-TEST-CASE-0506, LMA-TEST-CASE-0507, LMA-TEST-CASE-0508, LMA-TEST-CASE-0509, LMA-TEST-CASE-0510, LMA-TEST-CASE-0519, LMA-TEST-CASE-0520, LMA-TEST-CASE-0521, LMA-TEST-CASE-0522, LMA-TEST-CASE-0523, LMA-TEST-CASE-0524, LMA-TEST-CASE-0525
Control planning link; implementation should associate each requirement with the assertions that verify it. Cases are PLANNED. Absence of support or instrument is recorded as a gap, never converted into PASS.
Phase: P0. Status: PROPOSED.
M0: OPTIONAL. G0: OPTIONAL.
Class: CORRECTNESS / ARCHITECTURE. Status: PROPOSAL; evidence of pending product.
Linux: clone/clone3 · GCC: __atomic builtins · Clang: ThreadSanitizer
Worker stacks have limits and guards where the backend allows; the kernel does not make a small stack automatically secure. Canaries, probes, shadow stack, CET/BTI/PAC when applicable and TLS required are qualified together with compiler flags. Do not remove a control required to get link without runtime.
The critical scenario of reap is a delayed writing of the child/kernel in child_tid or registration after reuse. The test injects child retention, multiple joiners, timeout and joiner failure; output confirmation is required before dislocating the storage. Asynchronous cancellation and owner death require separate treatment; reset lock does not automatically recover the heat it protected.
Atomic storage itself needs field isolation and width/alignment validation. Flag corruption does not allow arbitrary transition. Release/acquire omission can create partially visible objects, even without null pointer. Memory order revisions invalidate related evidence.
LMA-SEC-013-R01. MUST qualify stack/TLS protections with raw runtime and block flags without runtime support.
LMA-SEC-013-R02. MUST test UAF thread control and late kernel write by appropriate model/fixture.
LMA-SEC-013-R03. MUST specify owner death treatment without turning timeout into possession.
LMA-SEC-013-R04. MUST include assembly/intrinsic changes and memory orders in the security gate.
LMA-SEC-013-I01. Recovery of a stack requires actual termination and end of observers.
LMA-SEC-013-I02. A corruption mitigation does not replace the correct competitor semantics.
LMA-TEST-CASE-0429, LMA-TEST-CASE-0430, LMA-TEST-CASE-0431, LMA-TEST-CASE-0432, LMA-TEST-CASE-0433, LMA-TEST-CASE-0434, LMA-TEST-CASE-0435, LMA-TEST-CASE-0436, LMA-TEST-CASE-0437, LMA-TEST-CASE-0438, LMA-TEST-CASE-0439, LMA-TEST-CASE-0440, LMA-TEST-CASE-0441, LMA-TEST-CASE-0442, LMA-TEST-CASE-0443, LMA-TEST-CASE-0444, LMA-TEST-CASE-0445, LMA-TEST-CASE-0446, LMA-TEST-CASE-0447, LMA-TEST-CASE-0448, LMA-TEST-CASE-0449, LMA-TEST-CASE-0450, LMA-TEST-CASE-0451, LMA-TEST-CASE-0503, LMA-TEST-CASE-0504, LMA-TEST-CASE-0505, LMA-TEST-CASE-0506, LMA-TEST-CASE-0507, LMA-TEST-CASE-0508, LMA-TEST-CASE-0509, LMA-TEST-CASE-0510
Control planning link; implementation should associate each requirement with the assertions that verify it. Cases are PLANNED. Absence of support or instrument is recorded as a gap, never converted into PASS.
Phase: P0. Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Class: CORRECTNESS / ARCHITECTURE. Status: PROPOSAL; evidence of pending product.
Linux: cgroup v2 · AFL++: Fuzzing in Depth · Clang: AddressSanitizer
Massive campaigns never automatically use almost all RAM from the host. They use VM/cgroup/job own limit, process budget/CPU/disk and supervisor reserve. The requirement of almost all memory is applied to share of disposable environment, The supervisor lives outside the domain that will be exhausted.
Separate OOM injected with deterministic return, real refusal of map/commit and death by OOM killer. Only the first two allow requiring normal failure treatment by the allocator. The dead process cannot perform cleanup or return NULL; the evidence must say RESOURCE_KILL, with host events, without registering OOM API PASS.
Fixtures of UAF/OOB/double free test detectors in separate subprocesses. They do not run C defined or benchmarked and are not examples C to copy. The matrix records expected detector, fault signature and negative control valid. Corpus and build plans are unreliable inputs: parsers have size/recursion limits, paths do not escape root, commands do not pass shell and artifacts are identified by hash.
LMA-SEC-014-R01. MUST impose isolation and explicit limits before performing destructive pressure, mutation or fixtures.
LMA-SEC-014-R02. MUST distinguish ENOMEM return, timeout, resource unavailable, kill and corruption crash.
LMA-SEC-014-R03. MUST maintain corpus, minimizers, manifests and logs under entry and budget validation.
LMA-SEC-014-R04. MUST NOT execute arbitrary payload as instructions or use the allocator_id field as shell command.
LMA-SEC-014-I01. A workload does not exhaust the supervisor's resources that should gather his evidence.
LMA-SEC-014-I02. Expected failure is only accepted when it corresponds to the pre-registered detector/signature.
LMA-TEST-CASE-0347, LMA-TEST-CASE-0348, LMA-TEST-CASE-0349, LMA-TEST-CASE-0350, LMA-TEST-CASE-0351, LMA-TEST-CASE-0352, LMA-TEST-CASE-0353, LMA-TEST-CASE-0354, LMA-TEST-CASE-0355, LMA-TEST-CASE-0356, LMA-TEST-CASE-0357, LMA-TEST-CASE-0358, LMA-TEST-CASE-0359, LMA-TEST-CASE-0360, LMA-TEST-CASE-0385, LMA-TEST-CASE-0386, LMA-TEST-CASE-0387, LMA-TEST-CASE-0388, LMA-TEST-CASE-0389, LMA-TEST-CASE-0390, LMA-TEST-CASE-0391, LMA-TEST-CASE-0392, LMA-TEST-CASE-0393, LMA-TEST-CASE-0394, LMA-TEST-CASE-0395, LMA-TEST-CASE-0396, LMA-TEST-CASE-0503, LMA-TEST-CASE-0504, LMA-TEST-CASE-0505, LMA-TEST-CASE-0506, LMA-TEST-CASE-0507, LMA-TEST-CASE-0508, LMA-TEST-CASE-0509, LMA-TEST-CASE-0510, LMA-TEST-CASE-0511, LMA-TEST-CASE-0512, LMA-TEST-CASE-0513, LMA-TEST-CASE-0514, LMA-TEST-CASE-0515, LMA-TEST-CASE-0516, LMA-TEST-CASE-0517, LMA-TEST-CASE-0518
Control planning link; implementation should associate each requirement with the assertions that verify it. Cases are PLANNED. Absence of support or instrument is recorded as a gap, never converted into PASS.
Phase: P0. Status: PROPOSED.
M0: REQUIRED. G0: REQUIRED.
Class: CORRECTNESS / ARCHITECTURE. Status: PROPOSAL; evidence of pending product.
Valgrind: Memcheck and memory pools · AFL++: libdislocator · Clang: ThreadSanitizer · Clang: MemorySanitizer
Sanitizers, coverage, fuzzing and Valgrind have different requirements. Strict production does not depend on runtime ASan/TSan/MSan, libFuzzer, test framework, libgcov or LLVM profile runtime. These components may compose separate verification artifacts, with own identity and allowlist; the raw-only target is not renamed to hide the difference.
Valgrind notes of memory pool are the optional exception of included already requested; the macro client request is not a production allocator. ASan does not automatically know the limits of each slot obtained by raw mmap. TSan may not observe threads and own synchronization. MSan requires modeling the bytes initialized by syscalls. Each detector has sensitivity test and false positive; if you do not observe the real backend, the combination is UNSUPPORTED/INCONCLUSIVE, not green.
Libdislocator replaces the malloc family and is useful to validate application/harness or as diagnostic comparator. Do not put it on the LMA test and assign to the LMA the detection made by another heap. The given term “Muted” remains registered as unidentified; Mull is the mutation testing tool explicitly selected in this proposal, without stating equivalence of names.
LMA-SEC-015-R01. MUST separate production dependencies and verification artifacts, including instrumentation inserted by the compiler.
LMA-SEC-015-R02. MUST confirm that each detector sees the actual target allocations/synchronizations.
LMA-SEC-015-R03. MUST NOT assign the LMA results obtained by replacing your heap with libdislocator or sanitizer allocator.
LMA-SEC-015-R04. MUST fail to qualify when mandatory detector is not operational in the announced backend.
LMA-SEC-015-I01. An integration that does not detect the positive fixture cannot declare the suite clean.
LMA-SEC-015-I02. Production semantics remains identified when the tool requires distinct bridge.
LMA-TEST-CASE-0475, LMA-TEST-CASE-0476, LMA-TEST-CASE-0477, LMA-TEST-CASE-0478, LMA-TEST-CASE-0479, LMA-TEST-CASE-0480, LMA-TEST-CASE-0481, LMA-TEST-CASE-0482, LMA-TEST-CASE-0483, LMA-TEST-CASE-0484, LMA-TEST-CASE-0485, LMA-TEST-CASE-0486, LMA-TEST-CASE-0487, LMA-TEST-CASE-0488, LMA-TEST-CASE-0489, LMA-TEST-CASE-0490, LMA-TEST-CASE-0491, LMA-TEST-CASE-0492: Ledger without a debit, LMA-TEST-CASE-0493, LMA-TEST-CASE-0494, LMA-TEST-CASE-0495, LMA-TEST-CASE-0496, LMA-TEST-CASE-0519, LMA-TEST-CASE-0520, LMA-TEST-CASE-0521, LMA-TEST-CASE-0522, LMA-TEST-CASE-0523, LMA-TEST-CASE-0524, LMA-TEST-CASE-0525
Control planning link; implementation should associate each requirement with the assertions that verify it. Cases are PLANNED. Absence of support or instrument is recorded as a gap, never converted into PASS.
These entire files are examples of contracts and of two arithmetic helpers, no implementations of allocator, GC, threads, futex or atomics. Each block C is identical to the relative file specified. They use their own types and none includes default. The adaptive type is intentionally restricted to compilers that provide the tested tokens; this does not qualify all compilers of the matrix.
The headers follow the leaf contracts and can be checked individually. LMA_NULL is the project constant, used with corresponding cast, without redefining NULL standard memory/atomics identifiers mentioned in prose describe boundaries or prohibitions, not dependency authorization. main is hosted for local execution; the two auxiliary objects also go through freestanding compilation and symbol inspection. A hosted link of the harness does not demonstrate a production executable without CRT.
The complete example is embedded below as lma_status.h.
#if !defined(LMA_STATUS_H) #define LMA_STATUS_H /* Project-local values; these are not platform errno numbers. */ #define LMA_OK ((int)(0)) #define LMA_EINVAL ((int)(-1)) #define LMA_EOVERFLOW ((int)(-2)) #define LMA_ENOMEM ((int)(-3)) #define LMA_EBUSY ((int)(-4)) #define LMA_ENOTSUP ((int)(-5)) #define LMA_EAGAIN ((int)(-6)) #define LMA_ECORRUPT ((int)(-7)) #define LMA_EIO ((int)(-8)) #define LMA_EINTR ((int)(-9)) #define LMA_ETIMEDOUT ((int)(-10)) #define LMA_EPERM ((int)(-11)) #endif /* LMA_STATUS_H */
Performance geometry, a CAS backend, early descriptor reclamation, MemProf integration, platform profiles, and quantitative latency limits require implementation and evidence. The simple initial design is the reference path, not a claim of optimal performance. Review changes to these contracts before changing code or ABI.
These references describe mechanisms and tool contracts. They do not establish product qualification.
Product status: implementation, concurrency qualification, proofs, and benchmarks remain pending.
These references describe mechanisms and tool contracts. They do not establish product qualification.
Linux: clone/clone3. Kernel interface and distinction between libc wrapper and crude syscall. TLS, flags and stacks continue implementation responsibilities.
Microsoft: Calling Internal APIs. Microsoft documents that internal interfaces can change. It does not substantiate promise of stable Windows syscall numbers.
Apple: syscall(2), historical file. Filed manual of indirect interface; does not qualify modern rough ABI, current iOS, TLS or store distribution.
GCC: __atomic builtins. Compiler extension semantics. Non-lock-free operations can produce external calls; require lowering audit.
Clang: ThreadSanitizer. Data race detector with runtime and limited platforms; assembly and own threads require separate observability campaign.
Linux: cgroup v2. Limits, pressure and OOM events; a kernel dead process did not return an allocator error.
AFL++: Fuzzing in Depth. Corpus, strategies and modes of execution; instrumental environments and budget are part of the campaign.
Clang: AddressSanitizer. Instrumentation and runtime; own suballocations require logical delimitation of valid accesses and detector tests.
Valgrind: Memcheck and memory pools. Client requests describe logical allocations of a proper allocator; measure separately from the native binary.
AFL++: libdislocator. Heap replacement library to detect problems in applications. Replace malloc with it does not automatically test the LMA heap.
Clang: MemorySanitizer. Tracking uninitialized values; uninstrumented external code and raw syscalls require shadow state integration.