Search papers, labs, and topics across Lattice.
PTSan is an LLVM-based memory safety sanitizer that enhances pointer-based checking for C/C++ by embedding object identifiers in pointer high bits and utilizing a runtime table for bounds. This approach significantly reduces overhead while maintaining compatibility and detection coverage, achieving a geomean overhead of 57.2% on SPEC CPU 2017, comparable to the fastest location-based sanitizers. By enabling efficient metadata management and hardware support through Intel Linear Address Masking, PTSan demonstrates that practical pointer-based memory safety can be achieved in production environments without excessive resource costs.
PTSan slashes memory safety overhead to just 57.2% while preserving robust detection capabilities, making pointer-based sanitization viable for production use.
Memory safety errors remain the dominant source of severe vulnerabilities in C and C++. Pointer-based sanitizers provide stronger guarantees than location-based tools such as LLVM's ASan, but their overhead and compatibility limitations have constrained production use. We present PTSan, an LLVM sanitizer that makes pointer-based checking practical by storing an object identifier in each pointer's high bits and its bounds in a fixed-size runtime table. This representation trades a finite live-object budget for low overhead, optimizer visibility, and commodity-hardware support. Because identity travels with the pointer value, ordinary LLVM dataflow propagates it without explicit per-pointer metadata instructions. Separating metadata lookup from check enforcement exposes both as LLVM IR, enabling check hoisting, elision, and merging, plus whole-function min-cut placement of compatibility tag strips. Intel Linear Address Masking eliminates the remaining strips in hardware when available. On stock hardware PTSan runs at parity with the fastest published location-based sanitizer: 57.2% geomean overhead on SPEC CPU 2017 on x86-64 (46.4% with Intel LAM), 54.7% on ARM64, and 31.5% (x86-64) on the application-shaped LLVM MultiSource suite. This is roughly a third of the published overhead percentage of prior systems with similar pointer-object authority guarantees, while preserving the inter-object, non-object, and temporal detection coverage measured by an independent memory safety test suite. Its physical-memory overhead is effectively native, a critical property for production deployment as memory costs become a first-order constraint. We also demonstrate practical overhead on real-world server and security workloads. These results show that PTSan brings practical pointer-based memory safety into a recompile-only sanitizer deployment model.
