Spatial memory safety

Why it matters

This directly addresses buffer overflows and other cross-object accesses in capability-aware software.

In brief

Spatial memory safety means an access stays within the intended object or region. CHERI capabilities carry bounds that the processor checks on memory operations, preventing an out-of-bounds capability use from silently reaching adjacent memory.

When evaluating spatial safety, test the boundaries that matter to the real object: one byte before, the first byte, the last permitted byte and one byte beyond. Also test derived pointers and sub-objects, because representable bounds and language rules affect what the implementation can enforce exactly.

Key considerations

1. Object bounds

Create capabilities whose range matches allocations, stack objects, code or shared buffers.

2. Hardware check

Reject a load, store or fetch outside the capability’s represented range.

3. Fault response

Diagnose, contain and recover from the exception according to system policy.

Evidence and caveats

Spatial protection does not by itself prevent use-after-free, uninitialised data, logic errors or misuse that remains inside a valid object’s bounds.

Use the exact architecture and software specification implemented by the target. Separate architectural guarantees from system-level outcomes.

Primary routes

• University of Cambridge CHERI