FloatZone: Accelerating Memory Error Detection Using the Floating Point Unit [pdf]

In a nutshell we use a probabilistic approach.

Whenever we get an FP exception due to a 0x8b8b8b8b we do the following:

1. We recover the address of the memory that caused the fault (i.e. the address where 8b8b8b8b is stored)

2. We start to count how many adjacent 8b there are. If we count at least 16 of them we know it's very likely our redzone

3. Finally we use what we call the "0x89 trick": the first byte of the redzone must be 89 (so a redzone looks like 898b8b8b...). If we also find this start marker then we are confident it's not a false positive.

Of course there can be still some false positives, however in programs is not that common to have the value 898b8b8b8b8b8b8b8b8b8b8b8b8b8b8b in memory.

This check is really expensive, however the nice property is that we get so few exceptions that in the end even if we waste a lot of time verifying for false positives the overhead is negligible.