Classic Papers on Memory Safety

This page compiles a list of classic and (I believe) to-be classic papers and articles on memory safety. All these publications are worth reading and re-reading. The definition of “classic” in this context is essentially impactful. However, classic/impactful does not necessarily mean the best of their class at the time. There are varied reasons for a work to be impactful, such as having strong support from a large organization. In addition, as you may have noticed, the lists are highly selective and somewhat (and inevitably) subjective. For a more comprehensive compilation of good papers to read, please see this. (I confess that I have not read many of the papers in the GitHub repo, so use it with caution. :-)

The publications are categorized as follows:

• Literature Review: Surveys and overview of the memory safety literature
• Offense: How memory safety bugs can be exploited and turned into vulnerabilities
• Safe Systems Languages: Mainly Safe dialects of C
• Safe Implementations: Retrofitting memory safety into C/C++ during compilation or binary rewriting
• Run-time Mitigations: Run-time mitigations against exploitations of memory safety errors
• Program Analysis: Static and dynamic analysis to detect memory safety errors

The classification of defenses mainly follows the Checked C paper. Note that many classic papers have an extended or revised version published later than the original. For these papers, I use the latest version.

I also sorted all the papers in chronological order. This is intended to provide a high-level overview for the development of the memory safety war.