Gang Tan, Department of Computer Science

Interface Safety in Multilingual Software

Most real software systems are multilingual; that is, they consist of components developed in different programming languages. Multilingual software systems are convenient in practice. Developers can reuse existing code modules, and can also mix and match strengths of different languages. As an example, imagine that a developer intends to perform data compression in Java. Instead of writing all the code for data compression from scratch, he can reuse the existing ZLib C library and write a thin interface between Java and C, via the Java Native Interface (JNI). In fact, this is exactly how Sun’s JDK implements the classes under java.util.zip.

Although multilingual software systems are convenient for developers and ubiquitous in practice, it is difficult to write safe and reliable multilingual software. It usually requires programmers to carefully take into account the discrepancies between languages on issues such as language features, data layout, memory management, safety/security assumptions, and many others. As an example, Java has built-in support for exceptions and exception handling, while C does not. Therefore, when developers write software that consists of both Java and C code, the C code has to check for exceptions in every possible place where they may occur, and provides code to handle them. Failure to do so may result in silent memory corruption. As one can imagine, this is an extremely error-prone process.

To address the safety and reliability issues in multilingual software, this project aims to

Perform inter-language analysis on existing multilingual software, for identifying and removing safety-critical bugs, and for performing inter-language optimization;
Formalize semantics of language interoperation (in frameworks such as the JNI and .NET);
Design mechanisms that facilitate the writing of reliable multilingual software.

Publications

An Empirical Security Study of the Native Code in the JDK. Gang Tan and Jason Croft. To appear in USENIX Security 2008, San Jose, California, USA, July 2008. (Preprint available upon request).
ILEA: Inter-Language Analysis across Java and C. Gang Tan and Greg Morrisett. To appear in ACM conference on Object-Oriented Programming, Systems, Languages & Applications (OOPSLA), Montreal, Oct 2007.
Safe Java Native Interface. Gang Tan, Andrew W. Appel, Srimat Chakradhar, Anand Raghunathan, Srivaths Ravi and Daniel Wang. In IEEE International Symposium on Secure Software Engineering (ISSSE 06), pages 97-106, March 2006.

Security Analysis of the Native Code in Sun's JDK. Jason Croft and Gang Tan. In 23rd Annual Computer Security Applications Conference (ACSAC), work-in-progress session, Dec 2007.

Last updated: Aug. 2007