Theory 063/Information & Computation /Software security
Memory Bugs Cluster at Ownership Boundaries
Bugs are counted per thousand lines. They may be concentrated where a pointer passes from one module to another.
Memory-safety defects concentrate where ownership of an object changes hands rather than uniformly across code, so defect density should be predicted by the number of ownership transitions rather than by lines of code.
01The evidence
Memory-safety vulnerabilities cluster in parsing and boundary code, and replacing those components eliminates a large share of the total.
02The tension
Defect density is reported per line or per function, which assumes uniformity. The clustering is noted but not modelled, so review effort is spread evenly.
03The mechanism
A memory error occurs when one component believes it owns an object and another also does, or neither does. The ambiguity arises at handoffs: allocation, transfer, return and deallocation across module boundaries.
That makes ownership transitions the risk sites, and predicts defect density should scale with transition count rather than with code volume.
04What this is not
Density models spread risk per line. This concentrates it at transitions, which predicts clustering.
05Predictions
- P1Defects should concentrate at ownership transitions.
- P2Transition count should predict better than lines.
- P3Ownership-typed languages should reduce the density.
06Refutation
Defects spread uniformly with transitions controlled would leave density models adequate.
07What it changes
It would target review and language design at boundaries.