compatmalloc

A drop-in memory-hardening allocator for Linux, written in Rust.

glibc's allocator prioritizes throughput over safety. Heap vulnerabilities -- use-after-free, buffer overflows, double frees, metadata corruption -- remain the most exploited bug classes in native software.

compatmalloc retrofits memory safety onto legacy C/C++ binaries without recompilation. Load it via LD_PRELOAD and every malloc/free call gains defense-in-depth hardening at near-native speed.

Quick Start

Build

git clone https://github.com/t-cun/compatmalloc.git
cd compatmalloc
cargo build --release

Output: target/release/libcompatmalloc.so

Use (10-second test)

LD_PRELOAD=./target/release/libcompatmalloc.so whoami

Harden any program

LD_PRELOAD=./target/release/libcompatmalloc.so python3 -c "
import json
data = [{'key': str(i), 'value': list(range(100))} for i in range(10000)]
json.dumps(data)
print('Success -- all allocations hardened')
"

Troubleshooting

If LD_PRELOAD appears to have no effect:

• Use an absolute path. LD_PRELOAD requires a full path or a library name findable via ld.so. Relative paths like ./target/... work from the repo root but not elsewhere.
• setuid/setgid binaries ignore LD_PRELOAD. This is a kernel security policy. Use /etc/ld.so.preload for system-wide coverage instead.
• Verify it loaded. Run LD_DEBUG=libs LD_PRELOAD=./target/release/libcompatmalloc.so ls 2>&1 | grep compatmalloc -- you should see it being loaded.

Performance

compatmalloc delivers hardened-allocator security at near-glibc throughput -- 3-4x faster than Scudo in microbenchmarks with comparable protections.

x86_64 (CI Results)

Latency ratio < 1.0 = faster than glibc. Throughput ratio > 1.0 = faster than glibc. Hardened allocators: compatmalloc, scudo. Both have security features (guard pages, quarantine, etc.) that add overhead vs pure-performance allocators.

Auto-generated from CI. See full benchmark results for ARM64, per-size latency, and application overhead data.

Real-World Application Overhead

Wall-clock time on shared GitHub Actions runners (no CPU pinning, no isolated cores). Results vary between runs due to noisy-neighbor effects, ASLR, and cache alignment. Negative overhead does not necessarily mean compatmalloc is faster -- it means the difference is within noise. These numbers show that overhead is low in practice, not that it is zero.

Security Features

What it catches

Limitations (honest assessment)

• Canary checks happen on free(), not on write. A 1-byte overflow is only detected when the overflowed chunk is freed. If it's never freed, the overflow goes undetected.
• Not async-signal-safe. Per-arena mutexes prevent safe use from signal handlers that may contend with the interrupted thread.
• Quarantine has a finite budget. After eviction, use-after-free on that address becomes undetectable.
• No inline bounds checking. Read overflows that stay within the slot size are invisible to canary checks.

CVE Case Studies

compatmalloc has been tested against real-world exploits:

• CVE-2024-2961 -- iconv buffer overflow (CVSS 8.8). Tcache poisoning via 1-byte overflow. Caught by canaries + out-of-band metadata.
• CVE-2023-6246 -- syslog heap overflow (CVSS 7.8). Local privilege escalation via su. Caught by canaries + guard pages.
• Double-Free Detection -- Immediate abort via out-of-band metadata flags.

Integration

Docker

A multi-stage Dockerfile is provided for container integration. Build the .so artifact first, then copy it into your application image:

# Build the artifact image (one-time)
docker build --target artifact -t compatmalloc-artifact .

Then in your application's Dockerfile:

# Copy the prebuilt .so from the artifact image
COPY --from=compatmalloc-artifact /libcompatmalloc.so /usr/lib/libcompatmalloc.so
ENV LD_PRELOAD=/usr/lib/libcompatmalloc.so

Or use the ready-made hardened base image directly:

docker build --target hardened-base -t my-hardened-app .
docker run --rm my-hardened-app whoami

Arch Linux (AUR)

# Once published to AUR:
yay -S compatmalloc

System-wide hardening:

# Add to /etc/ld.so.preload for system-wide protection
echo "/usr/lib/libcompatmalloc.so" | sudo tee -a /etc/ld.so.preload

See the PKGBUILD for packaging details.

Alpine / musl

compatmalloc supports musl-based systems (Alpine Linux) via both LD_PRELOAD and #[global_allocator].

LD_PRELOAD (container hardening):

docker build -f Dockerfile.alpine --target hardened-base -t myapp-hardened .

Rust native (#[global_allocator]):

cargo add compatmalloc --features global-allocator
cargo build --target x86_64-unknown-linux-musl

See the Dockerfile.alpine for packaging details.

Rust Native (#[global_allocator])

For Rust projects, skip LD_PRELOAD entirely. Add to Cargo.toml:

[dependencies]
compatmalloc = { git = "https://github.com/t-cun/compatmalloc.git", features = ["global-allocator"] }

Then in your main.rs:

use compatmalloc::CompatMalloc;

#[global_allocator]
static GLOBAL: CompatMalloc = CompatMalloc;

fn main() {
    // Every Box, Vec, String, and HashMap is now hardened.
    let data = vec![0u8; 1024];
    println!("Allocated {} bytes with compatmalloc", data.len());
}

This statically links the hardened allocator into your binary -- no .so file, no environment variables, no runtime dependencies.

Note: The global-allocator feature implies hardened (all security features enabled). To select individual features, use LD_PRELOAD with compile-time feature flags instead.

Configuration

Feature Flags (compile-time)

Build with selective hardening for performance tuning:

# All hardening (default)
cargo build --release

# No hardening (baseline performance)
cargo build --release --no-default-features

# Selective: only quarantine + canaries
cargo build --release --no-default-features --features quarantine,canaries

Roadmap

• LD_PRELOAD drop-in replacement (full glibc ABI)
• Multi-allocator CI benchmarks (x86_64 + ARM64)
• CVE case studies with proof-of-concept programs
• Docker integration
• Arch Linux PKGBUILD
• Native Rust #[global_allocator] support
• Alpine / musl support (LD_PRELOAD + #[global_allocator])
• Publish to crates.io
• Yocto/OpenEmbedded recipe for IoT devices
• Android (Bionic libc) compatibility
• ARM64 Memory Tagging Extension (MTE) integration

Trophy Case

Zero-days and bugs found by fuzzing with compatmalloc.

No trophies yet -- want to be first? Run your C/C++ programs with LD_PRELOAD=libcompatmalloc.so and report crashes to the upstream projects. Mention compatmalloc and we'll add it here.

Documentation

Full documentation: t-cun.github.io/compatmalloc

• ABI Contract -- every exported symbol and its semantics
• Hardening Details -- how each defense mechanism works
• Benchmarks -- full performance data with methodology
• Configuration -- all environment variables and feature flags
• Deviations from glibc -- known behavioral differences

Security

See SECURITY.md for reporting vulnerabilities.

Sponsorship

If your company uses compatmalloc to harden production infrastructure, consider sponsoring the project.

License

Dual-licensed under MIT and Apache 2.0.